[ac12644]

Medication changes read from free text could change a patient's record with no approval: in live runs 36–43% of medication-change sentences did (gpt-6-luna, gpt-5-mini, gpt-6-sol), most often leaving warfarin and apixaban both active after a switch. This fixes that, then makes the clinical preset automatic so clear changes don't need a person.

1. Safety fix (7f64efd)

The approval gate keyed on the model's action and subject labels, which vary. Every observed bypass is closed: an ADD beside an existing value, a stop filed as history / an event / an invented subject, a future-tense order outside the queue, a targeted change under a different subject, an unknown action that lost the message, brand names (Coumadin/Eliquis), and junk values ("held_for_contrast"). A sentence-level sweep catches stops the extraction dropped, and pending_changes / confirm_change warn before two anticoagulants would be current.

Live evaluation (benchmarks/evaluations/med_change_safety.py, real model calls): unsafe 93/112/105 of 260 before → 0 of 1,440 after, across 24 phrasings including 11 written after the fix; every expected change queued; latency unchanged (~2.1 s p50, all model time).

2. Automatic mode (b26d29f, 117a50a)

A gated slot now has a mode: "confirm": "auto" applies a clear change at once (marked auto_applied in history) and queues only an uncertain one: a hedge, a negation, a future-tense order, low confidence, a guessed action or rerouted subject, a sweep-only stop, or a change that would leave two anticoagulants active (so a switch applies whole or not at all). "confirm": true still means review; VAYL_CONFIRM_MODE=review|auto overrides every slot. The clinical preset puts medications on "auto" and keeps code status on "review".

Replay evaluation (benchmarks/evaluations/med_change_replay.py, no API calls): replays 2,048 recorded model outputs through the engine. The first auto run found 50 unsafe outcomes review mode had hidden (hold notes overwriting doses or added as fake drugs, a "continued" drug removed, a two-drug stop stored as one entry, a negated switch queued, a dose change breaking the drug's name); all fixed. After: 0 unsafe, 0 wrong; 97.7% of medication changes applied automatically (1,553 of 1,589). Engine time 0.07 ms per remember.

Not covered by replay: how often a model produces each shape on new text, or real-model behaviour on the 7 new risk phrasings (worst cases were used). Re-run the live harness with --risk when model credits are available.

Also

• An exhausted OpenAI quota (HTTP 429 insufficient_quota) fails at once instead of retrying for minutes; health shows "You have no credits remaining".
• More clinical hedges count as hypothetical ("probably", " if ", "consider", "plan to").
• Docs: safety guide ("Automatic or reviewed"), tutorial, configuration (VAYL_CONFIRM_MODE), glossary, troubleshooting, README. Pages whose captured output shows the approval queue now say they run with VAYL_CONFIRM_MODE=review.
• Report: benchmarks/results/med_change_safety.md.

Behaviour changes

• Clinical preset: clear medication changes now apply by themselves. Set VAYL_CONFIRM_MODE=review to keep approving every change.
• In review mode, adding a second medication from an untrusted source now needs approval (the preset's promise). Trusted feeds still apply directly.

Tests: 620 passed, 25 skipped; ruff and mypy clean; clinical acceptance 52/52.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com