- Shipped
- August 27, 2026 at 4:35 PM UTC
- Author
- Kamo
- Commit
- f40eefa
Every field in these bodies is read by name in app/lib/patients/ehrApi.ts and nothing was checking the server still emits them. The service tests pin that the exception CARRIES the data; nothing pinned that the handler puts it on the wire under the key the client looks for. A rename or a dropped entry between those two points is invisible from both sides -- server keeps passing, client silently reads undefined, screen degrades to the falsy branch. Two matter most. `reason` is what tells the client a 403 is a missing RIGHT rather than a missing BAA. Get it wrong and a member with the wrong role is told their whole organization is not enabled for clinical data, which sends them to the wrong person. `notChecked` is what stops the override card implying the safety review was complete. If it stopped being serialized the disclosure would vanish from the one screen that most needs it, and every test upstream of the handler would still pass. Mutation-checked: returning an empty list there fails two cases. Also pins that a relationship denial and a genuine miss render byte-identical bodies -- a caller who can tell them apart can walk the id space and learn which patients a practice has.