What v1.2.0 ships, annotated

gsm.safety's composite liver view had been reading some participants' own baseline as if it were an on-treatment peak. This part swaps the chart library under all eleven widgets from safety.viz v1.4.0 to v1.7.0, where the rule was corrected, adds two charts that had no R binding at all, and puts a parity guard in CI. Everything below is a run performed on 2026-08-22: both bundles, the same data, the same widget code.

Both captures below come from one report file. The widget code, the settings and all 57 929 rows of the example data are byte-identical between them — the two copies differ only in which safety.viz.js they load. Read the grey line above each chart pair: it is the module's own count of who made it into the plot.

Before · safety.viz 1.4.0

After · safety.viz 1.7.0

No participant changes quadrant. The Normal & Not-Notable count falls by two because the two participants who leave the plot were being counted there. Both halves matter: a reader checking the quadrant counts against the chart would find them moved, and a reader asking whether anyone's clinical classification changed would find that nobody's did.

The example data records a study day for every measurement. These are every ALT record the three affected participants have — read out of the package's own ExampleData("adbds") on 2026-08-22, nothing else selected or filtered.

There is no day-zero record, so the baseline resolves to the day-1.1 measurement. Because 1.1 is after day zero, the old rule kept that same record in the on-treatment set and reported the peak as 1.0000 ×ULN — the participant's own starting value. The peak is 0.3488 ×ULN, and this participant improved rather than peaked.

Total bilirubin behaves the same way for both: one record, serving as its own peak. A participant with no measurement after baseline has no on-treatment peak to plot, and is now counted among the excluded rather than drawn at their starting position.

Read out of each bundle's own reduction — the function whose return value the composite view hands to the chart — for the same 364 participants. Values are peak on-treatment, in multiples of the upper limit of normal.

Nine peaks move and not one of them rises. Every other participant's plotted position is identical between the two bundles, which is the other half of the claim worth checking: the rule change is confined to the participants it was meant to reach.

Both existed in the JavaScript library and had no R binding. Both captures below were produced by running the package's own report workflows on 2026-08-22 with the release's code and the release's bundled example data.

A safety overview leads with denominators: how many participants, how many dosed, how many died. gsm.safety computed those inside one function, from whatever columns it was handed, and got several of them wrong. This part replaces every one with a metric that publishes its own numerator, its own denominator and a record of where the figure came from, adds the report that reads them, and keeps SafetyCensus() by name with its arithmetic moved out. Both versions were run on 2026-08-22, on the same study, in the same session.

On the ecosystem's bundled study, the safety overview reported four deaths. Thirteen enrolled participants have a death recorded. The old count never opened the death domain at all: it matched the text of a discontinuation reason and counted whoever it found, enrolled or not.

Three of the sixteen were never enrolled — S42425, S97688 and S78705 — and the metric anchors every figure to the enrolled population of 762, so the published number is 13. The old count did not anchor, which is why it reported all four of its matches including the one who was never enrolled.

This is the trap the release exists to close, and it is also the reason this page was not built on the machine's own library: rendering the census here would have republished the superseded figures.

Both runs call SafetyCensus() on the same mapped domains from the same study, minutes apart: the census as v1.1.0 ships it first (the widget work in part 1 does not touch it), then this release's. Nothing below is copied from the release notes or the qualification records — those were read afterwards, to check this run against them.

Every figure that is published was measured twice, by routes that share no code, and the pair has to agree or the script exits non-zero. Run either yourself from the branch:

# the records read directly with base R, against the pipeline, figure by figure
Rscript tools/qualify-census-metrics.R
Rscript tools/qualify-death-count.R

#   AGREE - every figure measured twice, and saf0011 stops rather than publishing a zero.
#   AGREE - 13 participants, of 762 enrolled.

Both were run for this page and both agreed. Every row measured matches what inst/qualification/ records, including the eleven figures in the metrics record and all four counts in the death record.

One report, reading what the metrics published and computing nothing of its own. Rendered for this page by running the whole pipeline — the standard mapping, the eleven census metrics with a domain on this study, the reporting model, then the report workflow.

A zero means measured and found none. A blank means the reader has to guess. Both were being published where the honest answer is that nothing was collected. Run for this page: the same call, the same study, with the death domain withheld.

# the death domain supplied
Deaths                     13  of 762

# the death domain withheld — the same call, everything else identical
Deaths                     NA

# and it says so, rather than leaving the reader to notice:
Warning: No domain was supplied for Deaths (Study) (Mapped_Death);
         Participants With an ECG (Study) (Mapped_EG).
         Those figures are absent rather than zero.

On a study that maps no death domain, the death figure now reads as not collected instead of reading a discontinuation reason. That is correct, and it is also a visible change: the demo study's deaths and randomised tiles will read as not collected until its mapping phase adds those two domains.

The two renderers part 1 left on the deferral list ship here: the Kaplan-Meier time-to-event display and the participant profile. Both were held back by the same thing, and it was never the JavaScript: each needs a second data frame, and the widget contract carried one. The contract is now general. A widget reads the datasets its module's data contract names rather than assuming there is one, and the eleven existing widgets return byte-for-byte the payload they returned before. The deferral list in .github/parity-allowlist.yaml is empty, and a test asserts it equal to the suite's own list so the two can no longer disagree.

What each widget takes and draws, from the release notes and the merged pull request (gsm.safety#72, closing gsm.safety#71).

The FDA's Standard Safety Tables and Figures guide is mostly rules rather than drawings: three levels of laboratory abnormality, values so extreme they are treated as errors, results read as multiples of the upper limit of normal. Nothing in R carried those rules. This part is the foundation the static figures will stand on: the guide's appendix tables as package data, the first three functions that apply them to a lab table and hand the table back with the answers added, a requirement matrix that keys every one of the guide's 22 figures, and a column-by-column check of what the demo data can draw. Every number was produced from dev on 2026-09-11.

Appendix Tables 56 and 57 give the level 1, 2 and 3 abnormality thresholds the guide counts outliers against; Tables 58 to 60 give the values beyond which a result is treated as a laboratory or recording error and left out of the mean-change figures. They existed only as a PDF. They are now two data frames, transcribed row for row, with the printed criterion kept beside the parsed number and the guide page on every row.

The extreme-value table is long: every parameter appears twice, once in US-conventional units and once in SI, because the guide prints both and the data decide which one applies. The example data are mostly SI with bilirubin in both unit systems, which is exactly the case that would go wrong with one column.

> subset(FDA_AbnormalityLevels, Panel == "Liver Biochemistry",
+        select = c(Parameter, Direction, Basis, Operator, Level1, Level2, Level3, GuidePage))
                  Parameter Direction        Basis Operator Level1 Level2 Level3 GuidePage
       Alkaline phosphatase      high uln_multiple        >    1.5    2.0      3       120
   Alanine Aminotransferase      high uln_multiple        >    3.0    5.0     10       120
 Aspartate Aminotransferase      high uln_multiple        >    3.0    5.0     10       120
            Total Bilirubin      high uln_multiple        >    1.5    2.0      3       120

> subset(FDA_ExtremeValues, Parameter == "Glucose", select = c(Specimen, UnitSystem, Unit, Low, High))
 Specimen UnitSystem   Unit  Low High
   plasma         US  mg/dL 10.0 2700
   plasma         SI mmol/L  0.6  150

Each function takes the long lab table the example data already use, one row per participant per test per visit, and returns the same table with its answer added as new columns. Nothing is dropped and nothing is summarised, so a static figure and its interactive twin can read the same derived values. Derive_ULNMultiple() puts each result on the multiple-of-ULN scale. Derive_AbnormalityLevel() grades it against Tables 56 and 57 and says which direction and which printed criterion fired. Derive_ExtremeValueFlag() marks the results Tables 58 to 60 would exclude.

Every liver result in the example data, graded. The dashed lines are the Table 56 cuts read from the dataset above, not typed into the plot; the colours are the grade the function assigned. Bilirubin carries 30 level 3 results and alkaline phosphatase 12, which is what the eDISH quadrants will be drawn from in phase 1.

> dfLabs <- ExampleData("adbds")
> dfLabs <- Derive_AbnormalityLevel(dfLabs)
Derive_AbnormalityLevel left NA for records it could not evaluate:
  unit differs from the criteria's (mg/dL): Blood urea nitrogen in mmol/L, Calcium in mmol/L, Cholesterol (total) in mmol/L, Glucose in mmol/L, Phosphate in mmol/L
  qualifier 'Fasting' needs a column this function does not take: Glucose
  unit differs from the criteria's (g/dL): Albumin in g/L, Protein (total) in g/L
  basis 'baseline_multiple' needs a baseline column this function does not take: Creatinine
  needs a sex column (strSexCol) for the sex-qualified rows: Hemoglobin
  ... (the full list names every skipped parameter and why)

> dfGraded <- dfLabs[!is.na(dfLabs$AbnormalityLevel) & dfLabs$AbnormalityLevel > 0, ]
> table(dfGraded$TEST, dfGraded$AbnormalityLevel)
                               1   2   3
  Alanine Aminotransferase   102  10   0
  Alkaline Phosphatase       121  14  12
  Aspartate Aminotransferase  93   0   0
  Bilirubin                   15  71  30
  Chloride                   243  27   0
  Leukocytes                  35   9   0
  Potassium                   40   9   0
  Sodium                       5   2   0

The safety.viz renderers each carry a requirement matrix, and a test cites a row by its ID. The FDA figures now have one too, in the same shape: FDA-FIG-001 to FDA-FIG-022 for the 22 figures, numbered as the guide numbers them, and FDA-RULE-001 to FDA-RULE-016 for the rules the guide states once and several displays read. A static rendering here and an interactive one in safety.viz cite the same ID, so their evidence meets on one row.

$ grep -c '^| FDA-FIG-' requirements/fda-stf.md
22
$ grep -cE '^\| FDA-[A-Z]+-[0-9]+' requirements/fda-stf.md
38
$ grep -rho 'FDA-RULE-[0-9]*' tests/testthat/ | sort | uniq -c
      4 FDA-RULE-001
      6 FDA-RULE-002
      1 FDA-RULE-003
      3 FDA-RULE-004
      2 FDA-RULE-005
      1 FDA-RULE-008
      1 FDA-RULE-016

The guide is written against ADaM. gsm.safety holds two other shapes: the vendored example data and the Mapped_* domains gsm.mapping produces. The design assumed they aligned and said phase 0 should check. The note lists, for ADSL, ADAE, ADLB and ADVS, every column the 22 figures and the three derivations need, marks each as found, mapped, derivable or missing, and records a decision for every gap.

Each part was measured when its work landed, on the branch it landed on. Those branches are all inside dev, the candidate's branch, so what the parts measured is what the candidate ships; nothing was re-measured for the consolidation, and each part's provenance is kept as written.

Part 1

Part 2

Part 4

Repeat the comparison from a clean checkout. The second step is the whole method: build the report once, then give the copy the older library.

# the chart the release corrects, from the package's own workflow
Rscript -e 'lW <- yaml::read_yaml(system.file("workflow","4_modules","hep_explorer.yaml", package="gsm.safety"));
            w  <- gsm.safety::Widget_HepExplorer(gsm.safety::ExampleData("adbds"), lW$meta$lSettings);
            htmlwidgets::saveWidget(w, "after/hep_explorer.html", selfcontained = FALSE)'

# the same report, drawn by the bundle gsm.safety ships today
cp -R after before
mv before/hep_explorer_files/safety-viz-1.7.0 before/hep_explorer_files/safety-viz-1.4.0
cp <v1.1.0>/inst/htmlwidgets/lib/safety.viz-1.4.0/safety.viz.js \
   before/hep_explorer_files/safety-viz-1.4.0/safety.viz.js
sed -i '' 's|safety-viz-1\.7\.0|safety-viz-1.4.0|g' before/hep_explorer.html

# open both, choose the composite view, read the count line above the charts