ui phase 12

dev/shared-working-context/frontend/requests/for-backend.md

@@ -1034,7 +1034,28 @@ delivers fixes in its own change. **Frontend never edits backend code to "fix" a
   primary, `USE_PARTNER_MOCK`); the real client call is written but unreachable until this route exists.
 - **Status:** open
 
-## REQ-061 — Admin user lookup: name/phone search + batch id→label resolve — filed by ui-phase-11 — 2026-07-19
+## REQ-065 — Public/authenticated policy-config read (dispute window, cancellation tiers, refund ETA) — filed by ui-phase-12 — 2026-07-19
+- **Need:** A public or any-authenticated-caller read exposing the legally/financially sensitive policy
+  numbers that trust-critical copy states in plain language: the nurse-payout dispute-window hours
+  (currently 72), the cancellation lead-time tier boundary hours (currently 24), and the BNPL-revert
+  refund ETA business-day range (currently 7–10). Proposed: `GET api/v1/platform_config/public` (or a
+  narrower `.../policy_summary`) → `{ disputeWindowHours, cancellationLeadHours,
+  refundEtaMinBusinessDays, refundEtaMaxBusinessDays }` — a read-only projection of the existing
+  admin-only `platform_config` rows (`cfg_group_deadlines`/`cfg_group_cancellation`), not a new config
+  system.
+- **Why:** §3.6 of the phase-12 copy sweep parameterized `payouts.explainer_point_2`,
+  `refunds.lead_gt_24h`/`lead_lt_24h`, and `refunds.eta_business_days` to take `{hours}`/`{minDays}`/
+  `{maxDays}` instead of hard-coding the numbers into the string — but at authoring time only the
+  **admin-scoped** `platform_config/*` routes exist (verified against `dev/contracts/domains/`), so a
+  non-admin nurse/customer client has nothing to read these numbers from. Until this lands, the numbers
+  are single-sourced in `client/src/constants/policy.ts` (`DISPUTE_WINDOW_HOURS`,
+  `CANCELLATION_LEAD_HOURS`, `REFUND_ETA_MIN_BUSINESS_DAYS`, `REFUND_ETA_MAX_BUSINESS_DAYS`) and fed into
+  the three call sites (`CancellationPolicyDisclosure`, `RefundEtaBanner`, the nurse earnings
+  `ExplainerCard`) as ICU params — a config edit today still requires a client deploy to stay honest,
+  but at least the numbers live in exactly one file with a comment pointing at this REQ, not scattered
+  across message strings.
+- **Proposed shape:** as above; every field a plain number matching the admin config's current value.
+- **Status:** open
 - **Need:** Two endpoints backing a directory of platform users for admin use:
   1. `GET admin_users/search?q=&role=` — search by name/phone (min 2 chars), optionally narrowed to one
      coarse role (`customer`/`nurse`/`admin`/`partner`), returning up to ~10 matches: `{ id, displayName,