audit fixes (P1): medication reference correctness — H1, H2, M22

docs/branch-review-records/05d026fe646f677e39436ddceb09504fcdedcda3d1b0c75c914fc4bde2fb3b01.record.md

@@ -0,0 +1 @@
+| 2026-09-03 | claude/audit-fix-p1 (PR #2580) | d452aa87b41ca429d709a792e6d88594741a6b15 | Run PR sweep: CI fix + threads + drift | Before: mergeable_state blocked, 1 unresolved review thread (codex M22 finding: sign-off hash omits sourceDenySlugs), PR policy check failing (stale head), branch 1 commit behind main (clean). After: fixed the M22 gap (catalogueMappingsHash now hashes sourceDenySlugs; new test; regenerated review-sheet hash) commit 1effec45a; fixed a copilot-flagged brittle DOM test assertion (count-agnostic interaction-count match) commit 4c2084b23; merged origin/main twice as it advanced during the sweep, both clean (no conflicts, docs/ledger-only commits) commits 9abd85a4a and (fast-forwarded) d452aa87b — the second merge and a PR-body rewrite fixing the Clinical Governance Preflight checklist wording were pushed by a concurrent session working the same branch, verified via diff to contain no changes to my touched files. 2 of 4 review threads fixed and resolved (M22 hash gap, DOM test brittleness); 2 left open and replied to (duplicate finding across two files: grammar clarity of the sign-off disclaimer sentence) — deferred to the owner as clinician-facing safety-copy wording, consistent with the PR's own owner-decision items, and because this session may not edit the PR title/body where the generated copy's source of truth sits. PR policy check subsequently passed once the concurrent session's PR-body rewrite landed (confirmed via a fresh check run on 9abd85a4a/d452aa87b) — no action needed from this session on that finding. CI on the final head (d452aa87b) was still running (Static PR checks, Unit coverage, Build, Lighthouse) at sweep end; not babysat past the fixes-pushed point per policy. | npx vitest run tests/medication-lexicon-report-signoff.test.ts (13/13 passed), npx vitest run tests/medication-low-severity-verdict.dom.test.tsx (2/2 passed), npm run check:medication-lexicon-report (up to date, 37 catalogue terms; WARNING unchanged), npm run check:medication-interactions (up to date, 531 rows), npm run check:diff-integrity (PASS), npx tsc --noEmit -p tsconfig.json (clean), npx eslint on touched files (clean), npx prettier --check on touched files (clean); no provider-backed checks run; npm run test:focused refused (test/config-infra path changed) so narrower vitest runs were used directly instead of the full npm run test suite. |

docs/design-system/adoption-manifest.json

@@ -1802,6 +1802,7 @@
         "tests/header-scroll-hide-contract.test.ts",
         "tests/image-lightbox-geometry.test.ts",
         "tests/in-page-nav-route-sections.dom.test.tsx",
+        "tests/medication-lexicon-report-signoff.test.ts",
         "tests/mobile-sheet-safe-area-contract.test.ts",
         "tests/mode-nav-contract.test.ts",
         "tests/mode-nav.dom.test.tsx",

docs/medication-interaction-lexicon-review.md

@@ -1,6 +1,6 @@
 # Medication interaction lexicon — clinical review sheet
 
-**Status: reviewed 2026-08-22** — see the sign-off at the bottom. That sign-off covers the mappings as they stood on that date only. Any lexicon change made since is NOT covered by it: re-check every term the change touches, and say so in the sign-off.
+**Status: reviewed 2026-08-22 — NOT current.** That sign-off records no mappings hash, so nothing binds it to the table below (which now hashes to `f789156464c90d26b99a81c871db216bdedc2cd1de07a07f3fac9cbe88e0ea54`). This sheet therefore cannot say which of the terms below that sign-off still covers: re-check every term the change touched and re-record the sign-off with the current mappings hash. A sign-off covers the mappings as they stood on its own date only.
 
 Generated by `npm run medications:lexicon-report` from `src/lib/medication-interaction-lexicon.ts`.
 Do not hand-edit — fix the lexicon and regenerate. `npm run check:medication-lexicon-report` fails when
@@ -84,6 +84,20 @@ Drugs a selector would otherwise have swept in. Each is a clinical claim worth c
 | `corticosteroids` | Hydrocortisone 1%      | class `Steroid`, subclass `Topical Glucocorticoid`           |
 | `corticosteroids` | Triamcinolone          | class `Steroid`, subclass `Topical Glucocorticoid`           |
 
+## Source-side exclusions
+
+Records where a term is present in the text but is **not** read as naming a counterparty — usually
+because the record is using the class word for its own drug. Every interaction row on the record is
+affected, so each of these is a clinical claim worth checking.
+
+| Term       | Not read as a counterparty on | Rows affected | The wording it appears in                                                                                                                    |
+| ---------- | ----------------------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| `opioids`  | Loperamide                    | 1 of 1        | MODERATE — P-gp inhibitors (e.g., Verapamil, Ketoconazole) can theoretically push loperamide across the blood-brain barrier, causing opioid… |
+| `statins`  | Simvastatin                   | 1 of 3        | HIGH — Gemfibrozil (Fibrate) blocks statin glucuronidation and uptake, drastically increasing blood levels. Contraindicated combo.           |
+| `statins`  | Atorvastatin                  | 1 of 2        | HIGH — Gemfibrozil (Fibrate) blocks statin uptake, drastically increasing blood levels. Avoid combo.                                         |
+| `fibrates` | Simvastatin                   | 1 of 3        | HIGH — Gemfibrozil (Fibrate) blocks statin glucuronidation and uptake, drastically increasing blood levels. Contraindicated combo.           |
+| `fibrates` | Atorvastatin                  | 1 of 2        | HIGH — Gemfibrozil (Fibrate) blocks statin uptake, drastically increasing blood levels. Avoid combo.                                         |
+
 ## Terms that resolve to no catalogue drug
 
 These never produce an alert. `nonDrug` and `external` are deliberate; `mechanism` is an admission that