**FAIL — 3 Medium blockers**

1. **Preset HMAC does not bind the actual preset values**  
   `medication_contract.py:142-172` signs only `[stored_revision, prescription_id, medication_name]`. Quantity, dosage form, strength, route, source, and provenance are not included, nor is the stored revision recomputed from them. Changing preset fields while retaining the revision therefore yields the same “verified” `preset_revision`. The later preview binds the current row, but it cannot establish that the preset displayed as verified matches the revision’s approved values.

2. **Status polling receipts are not bound to the submitted payload/action hash**  
   `health_dashboard_server.py:983-1007` reads only `{status}` from `capture-receipts/<idempotency_key>.json`; `health_dashboard_action_worker.py:2360+` writes receipts by idempotency key without payload hash/revision. Reusing a key with different content can expose a stale `processed` receipt immediately, while the worker later rejects the conflicting action. The UI can therefore report “Gespeichert” for an action that was not applied.

3. **Ambiguous AJAX submission rotates the idempotency key**  
   `dashboard-v5-record.js:849` creates the key during preview, but the capture failure path at `:868` discards `frozen`; the next preview creates a new key. If the POST reached the server but its response was lost, retry is a new action rather than a replay. Normally duplicate detection rejects it, but when `duplicate_confirmed` remains checked, the second identical medication event can be inserted.

**Other reviewed boundaries passed:** preview/confirm reuse the same one-time capture CSRF and frozen payload; confirm consumes the token; planned mode requires an active trusted prescription and real unconsumed plan; historical mode cannot consume a plan; errors are sanitized; public references remain opaque; polling requires authenticated same-origin access.

- Verification: focused suites passed, **21 tests passed**; `git diff --check` passed.
- Files modified/created: **none**.
- Issues encountered: none.