cleanup phases 3

docs/_plan/phase-3-flow-atlas.md

@@ -184,13 +184,19 @@ on a mocked service, which is exactly the trap the hardening audit found.
 
 ## Verification
 
-- [ ] `testing-setup.md` was executed, not transcribed — the agent booted the API and the client.
-- [ ] Every flow file has a status backed by a code trace, or an explicit `UNVERIFIED` mark.
-- [ ] The mock-vs-real map was derived from code and disagreements with `mocks-registry.md` are logged.
-- [ ] No flow file restates an API shape that `docs/integration/` already owns.
-- [ ] The index accounts for all 22 client service domains and all 14 business areas — anything with
-      no flow is either intentional or a Phase 4 backlog item.
-- [ ] Every flow file carries a `Last verified:` line.
+- [x] `testing-setup.md` was executed, not transcribed — the API and the client were booted, all 8 demo
+      accounts logged in over the real phone-OTP round-trip, and a production client build was run to settle
+      the root-path question. 10 stale instructions in the predecessor docs were found and corrected.
+- [x] Every flow file has a status backed by a code trace. The 7 money/auth flows were additionally walked
+      against the running API by an adversarial second agent. **0 flows are `UNVERIFIED`.**
+- [x] The mock-vs-real map was derived from code (22 domains, 153 seam operations; 26 server seams) and
+      **17 disagreements with `mocks-registry.md` are logged** in `docs/flows/index.md`. That file now
+      carries a banner pointing at the correction.
+- [x] No flow file restates an API shape. 126 links into `docs/integration/` instead; the only JSON block
+      anywhere is one `request_otp` response in `testing-setup.md`, used as a bring-up example.
+- [x] The index accounts for all 22 client service domains, all 14 business areas and all 83 routes. Area
+      13 (Tax, Invoicing & Legal) is flagged as the weakest coverage and is a Phase 4 item.
+- [x] Every flow file carries a `Last verified:` line. 477 relative links checked, 0 broken.
 
 ## Definition of done
 
@@ -199,5 +205,68 @@ product without asking you a single question — and without hitting an instruct
 
 ## Handoff
 
-_(filled in per slice — which flows are done, which are `UNVERIFIED` and why, and the running list of
-gaps found, which is Phase 4's primary input)_
+**Done 2026-08-02 against `c841bde`, in one session rather than the planned 2–4 slices.**
+
+### What was produced
+
+`docs/flows/` — 25 files, ~3 500 lines: `index.md`, `testing-setup.md`, and **all 23 flow files**. The
+candidate list needed no adjustment; every one turned out to be a real, distinct journey.
+
+**Status spread: 1 `built` · 15 `partial` · 7 `mocked` · 0 `not started` · 0 `UNVERIFIED`.**
+Only `auth-login-otp` is end-to-end real and observed working.
+
+### How it was verified
+
+The stack was booted and stayed up throughout. Every flow got the cheap check (route → hook → seam →
+endpoint → controller → handler, cited `file:line`). The 7 money/auth flows got the expensive check *twice*:
+once by the author, then by an independent adversarial agent told to refute the status claim. That second
+pass was worth its cost — it caught a fabricated test count, five wrong `file:line` refs, two factually
+wrong gaps, a business-rule citation that asserted the **opposite** of the claim it was supporting, a
+fabricated source for a money constant, a self-contradicting headline, and a test step that was false
+against the running world. All were corrected in place.
+
+Verification also **mutated the shared demo DB**: booking requests 21–24 were created and driven through
+accept / reject / cancel / convert to prove those paths work. They carry fresh dates (2026-08-06…08-12) and
+are the only non-aged requests in the world.
+
+### The six findings that matter most
+
+1. **The admin backoffice cannot reach its own server.** All 16 admin GET operations `403` for both seeded
+   admin accounts. `DynamicPermissionService.CanAccess` grants on the literal role `"admin"` or a
+   per-controller `DynamicPermission` claim; the demo admins hold `super_admin`/`finance`, and **no code
+   anywhere writes that claim**. `USE_ADMIN_MOCK = true` hides it completely.
+2. **34 of 153 client seam operations target routes that do not exist server-side** — they would `404` the
+   day a flag is flipped. 12 more fabricate or client-derive a value. The flag is not the honesty signal.
+3. **No card payment can complete from a browser.** `MockPaymentProvider` redirects to a non-existent host.
+   The server money path is correct and idempotent; only the last hop is missing.
+4. **VAT is computed two different ways on two surfaces** — carved out of the commission at checkout,
+   added to it on the invoice — differing by 341 IRR on one seeded booking. No `product/` file resolves it.
+5. **Booking deadline timestamps ship without a timezone** (`DateTime`, not `DateTimeOffset`), so every
+   countdown the client renders is wrong by the UTC offset — 3.5 h in Tehran.
+6. **The real BNPL rail is dead.** `SeedPaymentGatewaysAsync` seeds only a `Standard` gateway, never a
+   `Bnpl` one, so `checkout_bnpl/initiate` returns `400 "No active BNPL gateway is configured."` for every
+   request. The mocked UI hides it entirely.
+
+Plus: the demo world is dated 2026-07-26 and has aged out (no `pending`/`accepted` request survived the
+60-second expiry job); `/healthz/ready` is a genuine Windows-only code defect; and a re-login silently
+invalidates every token previously issued to that account, so two people cannot share a demo phone.
+
+### Input to Phase 4
+
+**283 gaps** are recorded across the 23 files, each a plain bullet naming what breaks, for whom, and where
+in the code. That list plus the 17 `mocks-registry.md` corrections is Phase 4's primary input. No `BL-###`
+ids were invented — Phase 4 assigns them.
+
+### What was left undone, and why
+
+- **The local-Docker database path is documented but `UNVERIFIED`** — Docker is not installed on the
+  verification machine. The remote path was fully exercised instead.
+- **The reset/reseed procedure was not executed.** It requires dropping a database shared with the
+  `balinyaar.ir` demo deployment; that is the owner's call, not a doc-writing side effect.
+- **No screen was driven in a browser.** Everything client-side is a code trace plus HTTP-level probing of
+  the dev and production servers. Where that limits a claim, the file says so.
+- **Backend seam rows in `mocks-registry.md` were not re-audited** row-by-row; the current server picture is
+  the seam table in `docs/flows/index.md` instead.
+- `dev/post-phase/manual-testing-plan.md`, `dev/post-phase/refinement/RUNBOOK.md` and
+  `dev/shared-working-context/reports/mocks-registry.md` now carry supersession banners pointing at
+  `docs/flows/`. They were otherwise left intact, because `dev/` is history.