# Implementer — F-025 Reviews module

## Summary
Implemented reviews module with verified-purchase guard (order item must be DELIVERED and owned by user), unique constraint per order item, moderation by admin, and aggregate per product.

## Files changed
- `project/migrations/019_reviews.js`
- `project/src/modules/reviews/**`
- `project/src/app/build-app.ts`

## Acceptance evidence
- AC1 ineligible user -> 403: `reviews-service.test.ts` rejects with `ReviewNotEligibleError` when verifier returns false.
- AC2 duplicate review -> 409: existing review or repository race returns `DuplicateReviewError`; UNIQUE constraint at DB level enforces.
- AC3 only published reviews appear: `listPublishedByProduct` filters by status='published'.

## Commands run
- `cd project && npm run lint/typecheck/build/test` passed
- `cd project && TEST_DATABASE_URL='postgres://mdv:mdv_dev_only@localhost:5432/mdv_test' npm run test:integration -- migrations.itest` passed; 14 files, 53 tests
- `./scripts/verify.sh` passed

## Notes
- No new runtime dependency.
- Aggregates are computed live from `reviews_reviews`; cached aggregates can be added later without changing the public contract.