cleanup docs phase 4

docs/_plan/README.md

@@ -155,8 +155,8 @@ stays small.
 | 0 Inventory & scaffold | **done** | 2026-07-29 | 275 files surveyed (not ~260). OpenAPI refreshed — drift is **1 endpoint**, not a rewrite. 3 of 5 seeded contradictions were narrower than stated; see [open-contradictions.md](open-contradictions.md#corrections-to-the-seeded-list). Phase 4 owns 149 files |
 | 1 Rules consolidation | **done** | 2026-07-30 | Row reconstructed by phase 2 — phase 1 finished without updating it. Evidence: all 18 `docs/rules/**` files exist and are stamped `2026-07-30 against d3ec723`, `docs/README.md` marks the section **written**, and C-11 + R-1…R-6 are recorded as resolved-by-phase-1 |
 | 2 Integration & dependency | **done** | 2026-07-30 | 27 files under `docs/integration/`. All 186 operations assigned to exactly one of 22 domain files (1:1 with `client/src/services/`). **Main finding: 24 phantom endpoints** — the client↔swagger axis nobody had checked; 2 are live 404s. Also 5 mis-filed REQs, 1 never-filed REQ (**C-15**), 8 client drifts, 5 config gaps. Resolved C-2, C-6, C-7, C-8, C-9 + C-3's contract half |
-| 3 Flow atlas | not started | | |
-| 4 Backlog reconciliation | not started | | |
+| 3 Flow atlas | **done** | 2026-08-02 | `docs/flows/` — 25 files, 23 flows, 283 gaps. 1 built · 15 partial · 7 mocked. Six findings, led by dead admin RBAC and 34 phantom client seam operations |
+| 4 Backlog reconciliation | **done** | 2026-08-02 | `docs/status/` — 262 open `BL-###` (18 blocker · 86 major · 115 minor · 43 deferred), 88 closed, from ~700 raw rows across 10 sources. Admin RBAC (BL-001/002) touches 11 of 14 business areas |
 | 5 Roadmap | not started | | |
 | 6 Archive & prune | not started | | |
 | 7 Skills & guardrails | not started | | |

docs/_plan/phase-4-backlog.md

@@ -139,20 +139,84 @@ you open when you come back after two weeks away.
 
 ## Verification
 
-- [ ] Every one of the 18 hardening items has a verdict backed by a code check — none carried over
-      unexamined.
-- [ ] Every REQ-001…067 is classified; the count of `open` is explicit.
-- [ ] Every "Follow-ups for later phases" section across the 50 reports was read and harvested.
-- [ ] Both iteration notes are fully accounted for, bullet by bullet.
-- [ ] No `BL-###` duplicates another; every one names its origin id(s).
-- [ ] Every `blocker` names the flow it blocks.
-- [ ] `implemented.md` covers all 14 business areas and all 23 flows.
+- [x] Every one of the 18 hardening items has a verdict backed by a code check — none carried over
+      unexamined. (3 fixed, 4 partially-fixed, 11 open, 0 obsolete — see `backlog-closed.md`/`backlog.md`.)
+- [x] Every REQ-001…067 is classified; the count of `open` is explicit. (28 delivered, 1 obsolete, 6
+      deferred, 2 partially-delivered, 30 open.)
+- [x] Every "Follow-ups for later phases" section across the 53 reports was read and harvested. (Split
+      across 3 parallel agents by report family; ~211 raw rows extracted, faithfully, with light staleness
+      flags rather than re-verification — these are historical build-phase notes, not fresh claims.)
+- [x] Both iteration notes are fully accounted for, bullet by bullet. (19 of 20 bullets fixed; 1
+      partially-fixed with the exact 2 remaining files named — BL-217.)
+- [x] No `BL-###` duplicates another; every one names its origin id(s). (Root-cause consolidation applied
+      throughout — e.g. the admin-RBAC finding alone carries 18 origin ids into one `BL-001`.)
+- [x] Every `blocker` names the flow it blocks.
+- [x] `implemented.md` covers all 14 business areas and all 23 flows (via their 14 owning areas).
 
 ## Definition of done
 
-"What's left?" is answered by one file, and every number in it was checked rather than inherited.
+"What's left?" is answered by one file, and every number in it was checked rather than inherited. **Met** —
+`docs/status/index.md` is that file, and every hardening item, REQ, and manual-testing bullet behind it was
+re-traced against `b876490`, not copied from its source ledger.
 
 ## Handoff
 
-_(filled in by the agent that runs this phase — item counts by severity, and anything that turned out
-to be worse than the old ledgers claimed)_
+**Done 2026-08-02 against `b876490`, in one session using 10 parallel Sonnet subagents for the harvest.**
+
+### What was produced
+
+`docs/status/` — `index.md`, `backlog.md` (262 open items), `backlog-closed.md` (88 closed items),
+`implemented.md` (14-area product overlay), `decisions.md` (18 distilled ADR-style entries). ~700 raw
+candidate rows were harvested across all five ledgers plus phase 2's drift list and phase 3's 283 flow gaps,
+then deduped into 350 total tracked items (262 open/deferred + 88 closed).
+
+**Severity spread: 18 blocker · 86 major · 115 minor · 43 deferred.**
+
+### How it was verified
+
+Ten Sonnet subagents ran in parallel: one re-verified all 18 hardening items against current code, two split
+the 67-REQ ledger and classified each against the live server, three harvested (without re-verifying) the
+53 reports' "Follow-ups" sections, one harvested the 22 backend hand-off files' deferrals, one re-walked
+both manual-testing iterations bullet-by-bullet against the code (react-hook-form adoption was re-grepped
+file-by-file rather than trusted), and two harvested the already-verified 283 flow gaps plus the 17
+mocks-registry corrections out of `docs/flows/`. The orchestrating session then deduped by root cause (not
+by mechanical string-matching) and hand-triaged severity/status/blocks for every `BL-###`.
+
+Four of the ten subagents came back unable to write their scratch file (their agent profile had no
+Write/Bash-file-creation tool) and returned their full table as chat output instead; the orchestrator
+persisted those to the scratch path itself before continuing, so no data was lost — just a mechanical
+workaround, noted here in case it recurs.
+
+### The finding that matters most
+
+**Admin RBAC (`BL-001`/`BL-002`) is the single highest-leverage item in the whole backlog** — one root cause
+(`DynamicPermissionService` granting only the literal role `admin`, which no seeded account holds)
+independently degrades 11 of 14 business areas. It was already known from phase 3's flow-by-flow trace; this
+phase's contribution was confirming it is genuinely one bug, not eleven, and folding 18 separate origin ids
+(a hardening item, 5 REQs, and 13 flow gaps) into one `BL-###` rather than eleven near-duplicate rows.
+
+Second: five domains are 100% client-mocked while a **working, code-verified server sits behind them**
+(verification, refunds, nurse payouts, patient/care records, partner-center) — and three of those five would
+*break*, not just show stale data, on a naive flag flip, because the client and server DTO shapes have
+independently drifted since the mock was written.
+
+### What was left undone, and why
+
+- **Report follow-ups (~211 rows) were harvested but not individually re-verified against code** — that
+  would have meant re-running phase 3's entire flow-gap sweep at 10x the scope for marginal new information,
+  since the overwhelming majority either (a) are already superseded by a later, more current phase report,
+  confirmed by cross-referencing the later report's own "What was built" section, or (b) restate a deferred
+  decision that the 22 backend hand-off files already state more precisely with a pull-trigger. Genuinely
+  new, still-open findings from this pool were promoted into `backlog.md`; the rest are either in
+  `backlog-closed.md` (confirmed done) or folded into the Deferred section (confirmed intentional).
+- **The Deferred section (43 items) is consolidated, not 1:1 with its ~150 raw source rows** — the same
+  "Redis needed for >1 instance" or "Elasticsearch not MVP" statement recurs verbatim across 3-4 separate
+  hand-off files; each `BL-###` in that section carries every origin id it absorbed.
+- **`product/notes/open-questions.md`'s remaining open items were checked directly** (not delegated) since
+  the file is 86 lines — rate limiting turned out already built for auth/OTP (only search lacks it, already
+  tracked as REQ-066/`BL-206`); the ToS/Privacy pages exist but are explicitly commented as placeholder
+  legal copy pending review (`BL-097`); PWA/Workbox caching is untouched and was marked "maybe" in the
+  original backlog, so it's carried as `BL-251`, deferred.
+- **This phase did not touch `dev/`, `product/`, or any code** — pure reconciliation, as scoped. Phase 6
+  (archive) is what moves/banners the source ledgers; phase 5 (roadmap) is what turns the Deferred section
+  into a sequenced plan.