Capability keys, not roles
Creating a round mints two unguessable tokens, a caregiver key and a pharmacist key. The URL you open with (?k=) decides your role; the server derives it from which key matches, never from a self-declared label.
Confirm before every mutation
Every write tool suspends behind an in-page card until a human presses Confirm. The side-effect report is a declarative form (report_side_effect) that carries no toolautosubmit: an agent fills it, a person sends it.