cleanup docs phase 4

docs/status/index.md

@@ -1,33 +1,75 @@
 # Status — where the project actually is
 
-> **Populated by phase 4 — not yet written.** Phase 4 owns **149 of the 275 surveyed markdown files**,
-> by far the largest extraction job in the chain. Until then, open work is spread across five ledgers
-> that do not reference each other.
+> Last verified: 2026-08-02 against commit `b876490`. Populated by phase 4 of the
+> [documentation clean-up chain](../_plan/README.md).
 
-## Planned contents
+This is the page you open after two weeks away. "What's left?" now has one honest answer instead of five
+unreconciled ledgers.
 
-| File | Covers |
+## The picture in one table
+
+| | Count |
 | --- | --- |
-| `implemented.md` | The overlay: `product/`'s 14 business areas → build state. `product/` itself stays untouched |
-| `backlog.md` | Every open item as `BL-###`, triaged, each carrying its origin id |
-| `backlog-closed.md` | Items confirmed done, with what closed them |
-| `decisions.md` | The distilled decision log from the whole phase chain |
+| Flows: built · partial · mocked · not started | 1 · 15 · 7 · 0 (of 23) |
+| Business areas covered (of 14) | 14 — none orphaned; **area 13 (Tax, Invoicing & Legal) is weakest** |
+| Backlog items — open + deferred | **262** (`BL-001`…`BL-262`) |
+| — blocker | 18 |
+| — major | 86 |
+| — minor | 115 |
+| — deferred (has a pull-trigger) | 43 |
+| Backlog items — closed this phase | 88 |
+| Raw candidate rows harvested (pre-dedup, across 10 sources) | ~700 |
 
-## The five ledgers phase 4 reconciles
+Full detail: [backlog.md](backlog.md) (open) · [backlog-closed.md](backlog-closed.md) (closed) ·
+[implemented.md](implemented.md) (business-area overlay) · [decisions.md](decisions.md) (the ADR log).
 
-| Source | Size | Note |
-| --- | --- | --- |
-| [frontend/requests/for-backend.md](../../dev/shared-working-context/frontend/requests/for-backend.md) | 67 REQs, 104 K | Append-only; dispositions must be re-checked, not copied |
-| [hardening/issues.md](../../dev/post-phase/hardening/issues.md) | 18 items | **18 of 18 unticked**, last touched 2026-07-17 — while four later chains shipped. Re-verify each against code (**C-10**) |
-| `reports/*.md` "Follow-ups for later phases" | 53 reports | Every report has one. Confirmed present in all 53 |
-| `backend/handoff/*.md` | 22 files | Deferrals with pull-triggers |
-| [product/notes/open-questions.md](../../product/notes/open-questions.md) + [manual-testing/](../../dev/manual-testing/) ×2 | — | Business questions and two raw human feedback notes |
+## The five things standing between here and a usable product
 
-Plus [mocks-registry.md](../../dev/shared-working-context/reports/mocks-registry.md) (75 K) — the seam-by-seam
-mock/real status that `implemented.md` needs, and the only file that tracks it.
+1. **Admin RBAC is structurally dead ([BL-001](backlog.md#blockers-18)/[BL-002](backlog.md#blockers-18)).**
+   `DynamicPermissionService` grants only the literal role `admin`, which no seeded account holds — every
+   admin surface 403s. This one root cause independently degrades **11 of 14 business areas**
+   ([implemented.md](implemented.md#cross-cutting-the-rbac-finding)). Highest leverage fix in the backlog.
+2. **The two real money rails both dead-end before completion.** Card payment redirects to a host that
+   doesn't exist and nothing fires the PSP webhook locally ([BL-005](backlog.md#blockers-18)); no BNPL
+   gateway is ever seeded, so every BNPL call 400s, and the wizard's own mock cross-imports a store that
+   404s on any real booking id ([BL-007](backlog.md#blockers-18)/[BL-008](backlog.md#blockers-18)). Neither
+   money path can be walked end-to-end from a browser today.
+3. **Five domains are 100% client-mocked while a working server sits behind them** — verification, refunds,
+   nurse payouts, patient/care records, and the entire partner-center portal
+   ([BL-009](backlog.md#blockers-18), [BL-010](backlog.md#blockers-18), [BL-011](backlog.md#blockers-18),
+   [BL-012](backlog.md#blockers-18), [BL-013](backlog.md#blockers-18)). Three of the five would also *break*
+   on a naive flip — the client and server DTO shapes have drifted.
+4. **The booking payment window lies to the customer.** Deadline timestamps ship with no timezone, so in
+   Tehran a 30-minute countdown renders as ~4 hours and the request silently expires while the timer still
+   shows time left ([BL-006](backlog.md#blockers-18)).
+5. **Two pre-launch security items are live right now.** The repo's committed credentials (DB `sa`, both
+   encryption-key halves, three third-party API keys) have never been rotated
+   ([BL-003](backlog.md#blockers-18)), and a Development-only OTP-read endpoint is reachable on the
+   production domain because the deployment runs as Development
+   ([BL-004](backlog.md#blockers-18)).
 
-## Where decisions come from
+## Where to go next
 
-Every `dev/phases/*` prompt shares a fixed structure, and **§5 "Critical rules you must not get wrong"**
-is the section that states constraints *not visible in the code*. Verified present in all 32 prompts —
-that is the raw material for `decisions.md`. See [the inventory](../_plan/inventory.md).
+| Question | Answer |
+| --- | --- |
+| Is flow X built? | [docs/flows/index.md](../flows/index.md) — the status table, 23 flows |
+| How do I test it? | [docs/flows/testing-setup.md](../flows/testing-setup.md) |
+| What's the client↔server contract? | [docs/integration/index.md](../integration/index.md) |
+| What are the hard rules? | [docs/rules/index.md](../rules/index.md) |
+| What's open, and how bad is it? | [backlog.md](backlog.md) |
+| What's already closed? | [backlog-closed.md](backlog-closed.md) |
+| Which business area is built vs. mocked? | [implemented.md](implemented.md) |
+| Why was X built that way? | [decisions.md](decisions.md) |
+| What's next, in order? | [docs/roadmap/index.md](../roadmap/index.md) — phase 5, not yet written |
+
+## How this file's numbers were produced
+
+Five ledgers — the [hardening issues list](../../dev/post-phase/hardening/issues.md) (18 items, all
+unticked since 2026-07-16), the [67-REQ contract ledger](../../dev/shared-working-context/frontend/requests/for-backend.md),
+53 phase reports' own "Follow-ups" sections, 22 backend hand-off files' deferrals, and two rounds of raw
+manual-testing notes — were harvested in full, then every hardening item, every REQ, and every manual-testing
+bullet was **re-verified against the code at `b876490`**, not trusted as filed. Phase 3's **283
+already-verified flow gaps** (each with a live code trace, several walked against a booted server) are this
+phase's primary, freshest input and form the backbone of [backlog.md](backlog.md). Nothing here is copied
+from a stale document without a fresh check — the phase-chain's own rule (["verify, don't
+copy"](../_plan/README.md#non-negotiables-for-every-phase)) held throughout.