cleanup phase 5

2026-08-02 18:33:43 +03:30
parent cd8144e653
commit e2db97392a
9 changed files with 818 additions and 21 deletions
@@ -118,4 +118,65 @@ that piece and not another.

 ## Handoff

-_(filled in by the agent that runs this phase)_
+**Done 2026-08-02 against `cd8144e`, in one session, single agent (no subagent fan-out needed — the inputs
+were five already-triaged status files plus a handful of small product docs, not a fresh harvest).**
+
+### What was produced
+
+`docs/roadmap/` — `pre-launch.md`, `deferred.md`, `tech-debt.md`, `next-up.md`, `index.md`. All five
+verification checklist items pass: every deferred item in `backlog.md` (51 total — the labeled 43 plus 8
+more filed by severity elsewhere that also carry deferred status) appears in `deferred.md` with its trigger
+preserved in substance; all 8 unbuilt product tables are named individually; `pre-launch.md` covers credential
+rotation, all 11 still-mocked production rails, and the Development-in-production trade; every `next-up.md`
+unit names the backlog ids it closes and the flows it affects; proposal is labeled apart from record
+throughout (index.md marks each claim **recorded** or **this phase's proposal** explicitly).
+
+### How it was verified
+
+Read `backlog.md`, `implemented.md`, `decisions.md`, and `backlog-closed.md` in full (not sampled) since
+`next-up.md`/`deferred.md`/`pre-launch.md` all need to cite exact `BL-###` ids. Cross-checked the phase
+brief's tech-debt candidates against the actual code rather than restating them: **two turned out overstated.**
+"Absence of E2E tests over the money paths" — false as stated; `Baya.Test.Api` and `Baya.Test.Foundation`
+carry ~119 test files with real WebApplicationFactory integration coverage over Payments/Bookings/BNPL/
+Payouts/Refunds. The real gap, confirmed by grepping for Playwright/Cypress in `client/package.json` (none),
+is that nothing automated drives a real browser against a real API — a narrower, more precise claim than the
+brief's. "Test coverage asymmetry" — also not a raw-count gap (119 server files vs 125 client files); the
+actual asymmetry is that `docs/rules/server/cqrs.md` makes testing mandatory for every new feature while root
+`CLAUDE.md`'s client gate is reactive ("if you touched a tested component"). Both corrected in
+[tech-debt.md](../roadmap/tech-debt.md) rather than carried forward as-stated. One new debt item was found
+and added that the brief didn't name: no OpenAPI→TypeScript codegen pipeline exists (confirmed absent by grep),
+which is the mechanism that would have caught the client/server DTO drifts phases 2 and 3 had to discover by
+hand.
+
+One deferred item, [BL-245](../status/backlog.md#deferred-43), carried its own trigger — "phase 5 verification
+pass" — naming this phase directly. Rather than deferring it again, it was executed: grepped the server for
+`SuspendNurse`/`ResolveSupportAlert`/`FlagConcern`. Two of three are real and code-traced
+(`ResolveSupportAlert` + `AssignSupportAlert` in `SupportAlertsController.cs`; nurse suspension as
+`AdminSuspendVerificationCommand`); only `FlagConcern` is genuinely absent. Corrected in place in `backlog.md`
+and logged in `decisions.md`, both outside this phase's own output folder — a deliberate, narrow exception to
+"stay in your own phase's files," made because the alternative was knowingly publishing a roadmap that cites
+a stale row its own source phase had flagged as needing exactly this check.
+
+### The sequencing call worth flagging
+
+Applying the brief's stated principle (money/trust lies > unusable > mocked→real > new surface) literally
+puts admin RBAC ([BL-001](../status/backlog.md#blockers-18)/[BL-002](../status/backlog.md#blockers-18)) third
+in `next-up.md`, behind two smaller truth-fixes (nurse-verification status, checkout/payment-window honesty)
+— even though RBAC has zero prerequisites of its own and unblocks the most downstream work of anything in the
+backlog (11 of 14 business areas). `next-up.md` and `index.md` both say this outright rather than quietly
+picking one reading: the ranking follows the letter of the stated principle, and a reader who'd rather
+optimize for unlock-radius should run unit 3 first. Two more mocked domains that are just as legitimate as
+the four chosen (patient/care-records, partner-center) didn't fit the 3-5 slot cap and are named explicitly
+as next-in-line rather than silently dropped.
+
+### What was left undone, and why
+
+- **Patient/care-records and partner-center de-mocks are not among the 5 `next-up.md` units** — both are
+  real candidates (see above), left out only by the slot cap, not by judgment that they matter less.
+- **No code was written or changed** — pure roadmap synthesis, as scoped. The one exception is the BL-245
+  correction above, which is a fact-check, not a feature.
+- **This phase did not re-audit `product/business/*` line by line for "specified but never built" beyond what
+  `backlog.md`'s Deferred section already carries** — a grep for `DEFERRED` across all 14 business docs
+  confirmed every theme they name (the 8 tables, holiday/surge pricing, GPS discovery, double-blind reviews,
+  tiered commission, organizations, etc.) already has a `BL-###` home. Re-deriving that reconciliation from
+  scratch would have been redoing phase 4's job, not phase 5's.