| Register patient with all fields | Unit + Integration | Must |
| Register with only mandatory fields | Unit | Must |
| Duplicate detection blocks create (score ≥ 85) | Unit + Integration | Must |
| Unidentified create bypasses 409 block | Unit | Must |
| Idempotent create replay returns cached 201 | Integration | Must |
| MRN generated correctly per tenant | Unit | Must |
| Merge — survivorship rules applied | Unit + Integration | Must |
| Merge — source deactivated, identifiers transferred | Integration | Must |
| Unmerge — source reactivated | Unit + Integration | Should |
| Vital status record (deceased) | Unit + Integration | Must |
| Vital status correction (authorized role) | Unit | Must |
| Vital status rejected (unauthorized role) | Unit | Must |
| Encounter create and status machine (all transitions) | Unit + Integration | Must |
| Invalid encounter transition rejected | Unit | Must |
| Optimistic lock conflict on patient update | Integration | Must |
| Patient search: minimum-necessary criteria enforcement | Unit + Integration | Must |
| Break-glass audit metadata included | Integration | Must |
| Tenant isolation: cross-tenant patient access blocked | Integration (mandatory) | Must |
| Portrait upload with consent | Unit + Integration | Should |
| Portrait denied (clinical display = false) | Unit | Should |
| Extension schema validation | Unit | Should |
| Extension payload rejection on schema failure | Unit | Should |
| FHIR Patient read includes deceased mapping | Unit | Must |
| FHIR Encounter create maps to internal model | Unit | Must |
| HL7 ADT A01 inbound creates patient (adapter test) | Integration | Should |
| Provisional patient reconciliation merge | Integration | Should |
| Newborn registration with mother linkage | Unit | Should |