[3/4] Refuse to render measurements from a different growth reference

[pacharanero]

Safety driver

Hazard rcpch/digital-growth-charts-documentation#174 records a confirmed case where Trisomy 21 chart curves were displayed with a measurement tooltip calculated against UK-WHO. The technical investigation reproduced the two values exactly.

The component currently selects curves, title and attribution from RCPCHChartProps.reference, while measurement points and tooltips trust precomputed centiles and SDS from API data that has no reference provenance. It therefore cannot detect this inconsistent state.

Sequential delivery chain

1. rcpch/rcpchgrowth-python#37 adds the selected reference to every Measurement result.
2. rcpch/digital-growth-charts-server#207 passes that exact value through the API and OpenAPI schema.
3. This issue: reject data whose provenance cannot be proved consistent with the displayed chart.
4. rcpch/digital-growth-charts-documentation#175 documents the contract and records QMS and hazard mitigation evidence.

This is step 3, is blocked by step 2, and blocks step 4.

Required change

• Introduce and export one canonical public GrowthReference or GrowthReferenceId type. Do not reuse the existing internal curve-data type named Reference.
• Add required top-level reference provenance to the TypeScript Measurement interface.
• Validate runtime API data as well as TypeScript callers; JavaScript, UMD and persisted JSON cannot be protected by static typing.
• Before either Victory chart mounts, inspect every Measurement that can be rendered and fail closed when reference provenance is missing, unknown, mixed, or mismatched.
• For centile charts, validate the selected measurement-method array. For SDS charts, validate every populated method array because SDS can render several methods together.
• Run the guard beneath the existing ErrorBoundary so rejected data produces the standard chart error state rather than escaping the component.
• Do not render curves, points, tooltips or an exportable chart after rejection. The detailed error may identify the chart reference, measurement method and array index but must not contain patient data.
• Prevent a reference prop change from retaining stale internal measurements. Remount the child chart with a material-prop key or safely synchronize stored measurement state.
• Update all fixtures and stories with genuine calculation provenance. Do not make an unverified fixture pass by merely relabelling it.

Turner compatibility

The API's canonical value is turners-syndrome; the current chart prop uses turner. Use one explicit normalization function for comparison, or migrate/deprecate the legacy prop as part of the major release. Internal curve keys such as uk90_preterm, who_2006_infant and trisomy_21_aap_infant are not public aliases and must remain invalid as measurement provenance.

Compatibility and release

A required provenance field plus rejection of legacy untagged data is intentionally fail-closed and is a breaking runtime and TypeScript contract. Release it as a semver-major component version after steps 1 and 2 are available. Existing persisted API responses must be recalculated or explicitly migrated; silently accepting missing provenance would not provide the requested guard.

An empty chart with no measurement data may still render because there is no measurement/reference assertion to make.

Acceptance criteria

• Matching data for each of the six canonical references renders normally.
• who measurements supplied to a uk-who chart produce the standard error UI and no chart SVG, curves, points or tooltip.
• Missing, unknown and mixed references fail closed when measurement data is present.
• SDS rejects a mismatch in any populated method array, including a method other than the currently selected one.
• Empty measurement arrays remain valid.
• Turner data compares canonically without a false mismatch from turner versus turners-syndrome.
• Reference/data prop transitions cannot retain measurements from the prior reference.
• The error details are hidden initially, are non-sensitive, and identify the mismatch when expanded.
• Rejected data cannot invoke the chart export callback.
• Existing sex, method, gestation, date-of-birth and duplicate-measurement guards remain effective.
• Unit tests cover the pure reference validator; component tests cover centile, SDS, error UI and prop transitions.
• Storybook includes a reviewed mismatch/error state at default and custom dimensions.
• Prettier, build, Jest and Storybook build checks pass.
• The released major version and implementation PR are linked in step 4 and hazard Issue171-eatyourpeas-error-styles #174.