refinement phase 3

dev/contracts/domains/reviews-records.md

@@ -119,3 +119,19 @@ access rule is enforced in the handler, not just the route policy.
 - **Failure cases:** `401`; `403` no clinical access; `404` patient not found.
 - **Notes:** The record is **patient-scoped, not booking-scoped** — a new nurse taking over reads the whole
   history (not just their own booking's notes).
+
+---
+
+## Refinement phase 3 additions (REQ-026/027)
+
+- **`GET api/v1/bookings/{bookingId}/review_eligibility`** → `{ canReview, reason?:
+  not_completed|already_reviewed|not_owner|not_found }`.
+- **`GET api/v1/bookings/{bookingId}/my_review`** → `{ moderationStatus:
+  pending_moderation|published|hidden|rejected|none, rating?, body?, tagCodes[], createdAt? }`. Masked-author
+  omission on the public list is **intentional** (privacy).
+- **Family-owned care plan (new entity `usr.PatientCarePlans`):** `GET/PUT api/v1/patients/{patientId}/care_record`
+  → `{ patientId, medications:[{id,name,dosage?,frequency,timingNote?}], routine:[{id,label,timeOfDay?,note?}],
+  tasks:[{id,label,done}] }`. Read = owner/nurse-with-booking/admin; write = owning customer only.
+- **`GET api/v1/patients/{patientId}/record_access`** → `{ canView, canEdit, canAppendNote, deniedReason? }`
+  (always 200; non-leaking `not_found`/`not_authorized`).
+- **Structured `taskResults`** (`[{ label, done }]`) added to the visit-note write body + the history DTO.