# Status — where the project actually is

> Last verified: 2026-08-02 against commit `b876490`. Populated by phase 4 of the
> [documentation clean-up chain](../../archive/clarify-chain/README.md).

This is the page you open after two weeks away. "What's left?" now has one honest answer instead of five
unreconciled ledgers.

## The picture in one table

| | Count |
| --- | --- |
| Flows: built · partial · mocked · not started | 1 · 15 · 7 · 0 (of 23) |
| Business areas covered (of 14) | 14 — none orphaned; **area 13 (Tax, Invoicing & Legal) is weakest** |
| Backlog items — open + deferred | **262** (`BL-001`…`BL-262`) |
| — blocker | 18 |
| — major | 86 |
| — minor | 115 |
| — deferred (has a pull-trigger) | 43 |
| Backlog items — closed this phase | 88 |
| Raw candidate rows harvested (pre-dedup, across 10 sources) | ~700 |

Full detail: [backlog.md](backlog.md) (open) · [backlog-closed.md](backlog-closed.md) (closed) ·
[implemented.md](implemented.md) (business-area overlay) · [decisions.md](decisions.md) (the ADR log).

## The five things standing between here and a usable product

1. **Admin RBAC is structurally dead ([BL-001](backlog.md#blockers-18)/[BL-002](backlog.md#blockers-18)).**
   `DynamicPermissionService` grants only the literal role `admin`, which no seeded account holds — every
   admin surface 403s. This one root cause independently degrades **11 of 14 business areas**
   ([implemented.md](implemented.md#cross-cutting-the-rbac-finding)). Highest leverage fix in the backlog.
2. **The two real money rails both dead-end before completion.** Card payment redirects to a host that
   doesn't exist and nothing fires the PSP webhook locally ([BL-005](backlog.md#blockers-18)); no BNPL
   gateway is ever seeded, so every BNPL call 400s, and the wizard's own mock cross-imports a store that
   404s on any real booking id ([BL-007](backlog.md#blockers-18)/[BL-008](backlog.md#blockers-18)). Neither
   money path can be walked end-to-end from a browser today.
3. **Five domains are 100% client-mocked while a working server sits behind them** — verification, refunds,
   nurse payouts, patient/care records, and the entire partner-center portal
   ([BL-009](backlog.md#blockers-18), [BL-010](backlog.md#blockers-18), [BL-011](backlog.md#blockers-18),
   [BL-012](backlog.md#blockers-18), [BL-013](backlog.md#blockers-18)). Three of the five would also *break*
   on a naive flip — the client and server DTO shapes have drifted.
4. **The booking payment window lies to the customer.** Deadline timestamps ship with no timezone, so in
   Tehran a 30-minute countdown renders as ~4 hours and the request silently expires while the timer still
   shows time left ([BL-006](backlog.md#blockers-18)).
5. **Two pre-launch security items are live right now.** The repo's committed credentials (DB `sa`, both
   encryption-key halves, three third-party API keys) have never been rotated
   ([BL-003](backlog.md#blockers-18)), and a Development-only OTP-read endpoint is reachable on the
   production domain because the deployment runs as Development
   ([BL-004](backlog.md#blockers-18)).

## Where to go next

| Question | Answer |
| --- | --- |
| Is flow X built? | [docs/flows/index.md](../flows/index.md) — the status table, 23 flows |
| How do I test it? | [docs/flows/testing-setup.md](../flows/testing-setup.md) |
| What's the client↔server contract? | [docs/integration/index.md](../integration/index.md) |
| What are the hard rules? | [docs/rules/index.md](../rules/index.md) |
| What's open, and how bad is it? | [backlog.md](backlog.md) |
| What's already closed? | [backlog-closed.md](backlog-closed.md) |
| Which business area is built vs. mocked? | [implemented.md](implemented.md) |
| Why was X built that way? | [decisions.md](decisions.md) |
| What's next, in order? | [docs/roadmap/index.md](../roadmap/index.md) |

## How this file's numbers were produced

Five ledgers — the [hardening issues list](../../archive/post-phase/hardening/issues.md) (18 items, all
unticked since 2026-07-16), the [67-REQ contract ledger](../../archive/build-chain/working-context/frontend/requests/for-backend.md),
53 phase reports' own "Follow-ups" sections, 22 backend hand-off files' deferrals, and two rounds of raw
manual-testing notes — were harvested in full, then every hardening item, every REQ, and every manual-testing
bullet was **re-verified against the code at `b876490`**, not trusted as filed. Phase 3's **283
already-verified flow gaps** (each with a live code trace, several walked against a booted server) are this
phase's primary, freshest input and form the backbone of [backlog.md](backlog.md). Nothing here is copied
from a stale document without a fresh check — the phase-chain's own rule (["verify, don't
copy"](../../archive/clarify-chain/README.md#non-negotiables-for-every-phase)) held throughout.