## CHANGES REQUIRED

### High — Medication planning fails open and cancellation is not medication-specific
- `scripts/health/dashboard_v5/data_provider.py:156-174`
  - Any `scheduled_next_date` is accepted unless the event type is explicitly excluded. Empty, unknown, or misspelled event types therefore become a displayed plan.
  - The source row is not required to represent a past/actual administration; a future-dated “administered” row can contribute a later planned date.
  - Cancellation is matched globally by date, so cancellation of one medication suppresses an unrelated medication planned for the same date, despite medication identity being available in `database/schema.sql:237-248`.
  - `planned >= today` also retains same-day plans instead of requiring a strictly future next plan.
- End consequence: `dashboard-v5.js:301-310` can present unsupported or incorrectly suppressed data as **“Nächste geplante Medikation.”**
- Synthetic probes confirmed:
  - Unknown event type with `scheduled_next_date` was accepted as planned.
  - Cancelling Drug A on a date suppressed Drug B’s plan on that date.
  - A plan dated exactly `today` remained `next_planned`.

### High — “Verified labs only” is not enforced by the bundle contract
- Provider filtering is appropriately allowlisted at `scripts/health/dashboard_v5/data_provider.py:34-43,201-240`.
- However, `scripts/health/dashboard_v5/contracts.py:197-209`:
  - Requires only `quality == "verified_original"`.
  - Does not require `source_type == "scanned_original"`.
  - Does not constrain parameter/unit pairs to the canonical lab allowlist.
- A synthetic direct-contract probe successfully validated:
  - Free-text parameter `"FREE TEXT HOSPITAL LABEL"`
  - Arbitrary unit
  - `source_type: "xlsx"`
  - `quality: "verified_original"`
- End consequence: the strict bundle boundary can certify and render non-allowlisted, non-original-source lab data if a caller bypasses or regresses the current provider.

### High — Browser tests do not fail closed to synthetic-only data
- `tests/browser/dashboard_v5.spec.js:5-6` accepts any configured URL without verifying a synthetic fixture sentinel or manifest.
- The suite renders medication/lab/private data and print mode.
- `playwright.config.js:9` retains traces on failure; pointing the suite at a live dashboard could therefore persist private DOM/bundle content locally.
- `.gitignore` prevents committing those artifacts but does not prevent their creation.
- The Python fixture test checks `synthetic_only` at `tests/test_health_dashboard_v5.py:304-315`, but that assurance is not connected to the independently configured browser URL.

### Medium — Print/doctor output lacks an explicit Missingness disclaimer
- `scripts/health/dashboard_v5/render.py:65` includes original-verification provenance and no-diagnosis/no-treatment wording, but does not state that absent or incomplete data remains unknown.
- Print CSS explicitly unmasks private values at `dashboard-v5.css:219-233`.
- Browser print assertions at `tests/browser/dashboard_v5.spec.js:194-208` verify values and provenance, not the required Missingness/non-causal disclaimer set.

## Verification completed

- **125 Python tests passed**
- **18 focused Dashboard-v5 tests passed**
- **12 Playwright tests passed** against a synthetic `/tmp` database and generated dashboard
- `git diff --check`: passed
- Python compilation: passed
- Changed-tree secret-pattern scan: **0 hits**
- CSP/no-external-request/browser-console checks: passed
- Privacy mode is transient; verified-only provider path and future measurement/lab filtering otherwise behaved correctly
- Baselines are prior-only and honor each metric’s `baseline_min_observations`
- Events remain separate from measurement datasets
- v4 and server working-tree diffs: **0 lines**
- Final reviewed HEAD: `50d02e3b848c`

No source files were edited. Only transient synthetic test data was created under `/tmp`; no production health database was opened or copied.