# Implemented — the product overlay

> Last verified: 2026-08-02 against commit `b876490`.

The mapping [`product/`](../../product/index.md)'s 14 business areas need and never had: which flow builds
each area, and what state it's actually in. `product/` itself stays untouched — this file is the bridge
between "what the business is" and "what we built." States: `built` (end-to-end real) · `partial` (real with
named gaps) · `mocked` (UI real, data fake) · `not started` · `deferred`.

Every row's Gaps column links into [backlog.md](backlog.md); the full evidence is in the linked
[docs/flows/](../flows/index.md) file, not restated here.

## Business area → build state

| # | Business area | Doc | Primary flow(s) | State | Gaps |
| --- | --- | --- | --- | --- | --- |
| 01 | Actors & Onboarding | [product/business/01-…](../../product/business/01-actors-and-onboarding.md) | [auth-login-otp](../flows/auth-login-otp.md) **(built)**, [onboarding-customer](../flows/onboarding-customer.md), [onboarding-nurse](../flows/onboarding-nurse.md) | partial | BL-023, BL-031..038, BL-085..092, BL-193..197, BL-249 |
| 02 | Nurse Verification | [product/business/02-…](../../product/business/02-nurse-verification.md) | [nurse-verification](../flows/nurse-verification.md) | **mocked** | BL-010 (blocker), BL-080..084, BL-190..192, BL-214, BL-233 |
| 03 | Catalog & Pricing | [product/business/03-…](../../product/business/03-service-catalog-and-pricing.md) | [nurse-catalog-and-pricing](../flows/nurse-catalog-and-pricing.md) | partial | BL-018 (blocker — zero option groups outside Development), BL-069..072, BL-176..178, BL-231 |
| 04 | Search & Matching | [product/business/04-…](../../product/business/04-search-and-matching.md) | [search-and-discovery](../flows/search-and-discovery.md) | partial | BL-014 (blocker), BL-103, BL-104, BL-210..213, BL-221, BL-232 |
| 05 | Booking & Scheduling | [product/business/05-…](../../product/business/05-booking-and-scheduling.md) | [booking-request](../flows/booking-request.md) | partial | BL-006 (blocker), BL-040..044, BL-071, BL-138..143, BL-228, BL-260 |
| 06 | EVV / Service Delivery | [product/business/06-…](../../product/business/06-evv-and-service-delivery.md) | [booking-lifecycle-evv](../flows/booking-lifecycle-evv.md) | partial | BL-016 (blocker), BL-039, BL-043..046, BL-133..137, BL-259 |
| 07 | Cancellation & Refunds | [product/business/07-…](../../product/business/07-cancellation-and-refunds.md) | [cancellation-and-refunds](../flows/cancellation-and-refunds.md) | **mocked** | BL-009 (blocker), BL-047..054, BL-144..148, BL-215, BL-237 |
| 08 | Payments & Escrow | [product/business/08-…](../../product/business/08-payments-and-escrow.md) | [checkout-and-payment](../flows/checkout-and-payment.md) | partial | BL-005 (blocker), BL-058..062, BL-156..159, BL-253, BL-262 |
| 09 | Installments / BNPL | [product/business/09-…](../../product/business/09-installments-bnpl.md) | [bnpl-installments](../flows/bnpl-installments.md) | **mocked** | BL-007, BL-008 (blockers), BL-126..132, BL-227, BL-238 |
| 10 | Payouts | [product/business/10-…](../../product/business/10-payouts.md) | [nurse-earnings-and-payouts](../flows/nurse-earnings-and-payouts.md) | **mocked** | BL-012 (blocker), BL-073..076, BL-179..184, BL-240..242 |
| 11 | Reviews, Trust & Safety | [product/business/11-…](../../product/business/11-reviews-trust-and-safety.md) | [reviews](../flows/reviews.md) | partial | BL-017 (blocker), BL-099..102, BL-207..209, BL-243 |
| 12 | Messaging & Emergencies | [product/business/12-…](../../product/business/12-messaging-and-emergencies.md) | [messaging-tickets](../flows/messaging-tickets.md) | partial | BL-063..068, BL-160..168, BL-247, BL-261 |
| 13 | Tax, Invoicing & Legal | [product/business/13-…](../../product/business/13-tax-invoicing-and-legal.md) | [partner-center](../flows/partner-center.md) (+ invoice half of `checkout-and-payment`, VAT — see BL-060) | **mocked — weakest area** | BL-013 (blocker), BL-093..095, BL-198..201, BL-236, BL-239, BL-246, BL-254, BL-255 |
| 14 | Notifications & Admin | [product/business/14-…](../../product/business/14-notifications-and-admin.md) | [notifications](../flows/notifications.md) (partial), [admin-backoffice](../flows/admin-backoffice.md) (**mocked**) | **mocked (admin half)** | BL-001, BL-002 (blockers — the RBAC finding that touches 11 of 14 areas), BL-114..117, BL-124, BL-125, BL-169..175, BL-244, BL-245 |

**No area is orphaned** — all 14 map to a primary flow, matching [docs/flows/index.md](../flows/index.md)'s
coverage accounting. **Area 13 is confirmed the weakest**: invoicing and VAT are split across two flows with
no single owner, the entire partner-center portal is mocked with zero tenancy, and BNPL/invoicing can name
two different merchant-of-record centers for the same booking (BL-199).

**One flow has no `product/` source at all**: `account-and-settings` is a ui-phase-9 UI decision with no
business-area file behind it — not a gap in this table, just a fact worth knowing before editing it.

## Cross-cutting: the RBAC finding

[BL-001](backlog.md#blockers-18) (admin RBAC grants only the literal role `admin`, which no seeded account
holds) is the single defect with the widest blast radius in this table — it independently degrades the admin
half of areas 02, 07, 09, 10, 11, 12, 13 and 14, plus the admin-only surfaces inside 03, 05 and 06. Fixing it
does not fix any area's `mocked` state on its own (most of those are separately blocked by their own
`USE_*_MOCK` flag or missing route — see each row above), but it is the single highest-leverage fix in the
whole backlog: [docs/flows/index.md](../flows/index.md#the-six-things-that-surprise-everyone) independently
found the same root cause from the code side.

## Data model — never-built product tables

The STATUS logs and [product/data-model/index.md](../../product/data-model/index.md) name **8 tables**
modeled in the product data model that have no implementation today, all `[DEFERRED]` by product decision
(not oversight — see [decisions.md](decisions.md)):

| Table | Backs | Product doc |
| --- | --- | --- |
| `organizations` | Employer/company account model | [13-partner-centers-and-future.md](../../product/data-model/13-partner-centers-and-future.md) |
| `organization_nurses` | Employer↔nurse membership | same |
| `fraud_flags` | ML-scored fraud signals (manual suspension covers this today) | same |
| `recurring_booking_schedules` | Recurring/subscription bookings | same |
| `bnpl_settlement_entries` | Tranched BNPL settlement (one settlement row covers it today) | [08-bnpl.md](../../product/data-model/08-bnpl.md) |
| `nurse_availability_slots` | Soft scheduling-guidance windows | [05-booking-and-scheduling.md](../../product/data-model/05-booking-and-scheduling.md) |
| `nurse_availability_exceptions` | Time-off exceptions to the above | same |
| `incidents` | First-class incident entity (support alerts cover this today) | [11-reviews-trust-and-safety.md](../../product/business/11-reviews-trust-and-safety.md) |

None of these are backlog items — they're recorded product decisions to not build yet, carried in
[backlog.md](backlog.md)'s Deferred section (BL-222 through BL-247) with their pull-triggers.