baya-monorepo/docs/status/index.md

Status — where the project actually is

Last verified: 2026-08-02 against commit b876490. Populated by phase 4 of the documentation clean-up chain.

This is the page you open after two weeks away. "What's left?" now has one honest answer instead of five unreconciled ledgers.

The picture in one table

	Count
Flows: built · partial · mocked · not started	1 · 15 · 7 · 0 (of 23)
Business areas covered (of 14)	14 — none orphaned; area 13 (Tax, Invoicing & Legal) is weakest
Backlog items — open + deferred	262 (BL-001…BL-262)
— blocker	18
— major	86
— minor	115
— deferred (has a pull-trigger)	43
Backlog items — closed this phase	88
Raw candidate rows harvested (pre-dedup, across 10 sources)	~700

Full detail: backlog.md (open) · backlog-closed.md (closed) · implemented.md (business-area overlay) · decisions.md (the ADR log).

The five things standing between here and a usable product

1. Admin RBAC is structurally dead (BL-001/BL-002). DynamicPermissionService grants only the literal role admin, which no seeded account holds — every admin surface 403s. This one root cause independently degrades 11 of 14 business areas (implemented.md). Highest leverage fix in the backlog.
2. The two real money rails both dead-end before completion. Card payment redirects to a host that doesn't exist and nothing fires the PSP webhook locally (BL-005); no BNPL gateway is ever seeded, so every BNPL call 400s, and the wizard's own mock cross-imports a store that 404s on any real booking id (BL-007/BL-008). Neither money path can be walked end-to-end from a browser today.
3. Five domains are 100% client-mocked while a working server sits behind them — verification, refunds, nurse payouts, patient/care records, and the entire partner-center portal (BL-009, BL-010, BL-011, BL-012, BL-013). Three of the five would also break on a naive flip — the client and server DTO shapes have drifted.
4. The booking payment window lies to the customer. Deadline timestamps ship with no timezone, so in Tehran a 30-minute countdown renders as ~4 hours and the request silently expires while the timer still shows time left (BL-006).
5. Two pre-launch security items are live right now. The repo's committed credentials (DB sa, both encryption-key halves, three third-party API keys) have never been rotated (BL-003), and a Development-only OTP-read endpoint is reachable on the production domain because the deployment runs as Development (BL-004).

Where to go next

Question	Answer
Is flow X built?	docs/flows/index.md — the status table, 23 flows
How do I test it?	docs/flows/testing-setup.md
What's the client↔server contract?	docs/integration/index.md
What are the hard rules?	docs/rules/index.md
What's open, and how bad is it?	backlog.md
What's already closed?	backlog-closed.md
Which business area is built vs. mocked?	implemented.md
Why was X built that way?	decisions.md
What's next, in order?	docs/roadmap/index.md — phase 5, not yet written

How this file's numbers were produced

Five ledgers — the hardening issues list (18 items, all unticked since 2026-07-16), the 67-REQ contract ledger, 53 phase reports' own "Follow-ups" sections, 22 backend hand-off files' deferrals, and two rounds of raw manual-testing notes — were harvested in full, then every hardening item, every REQ, and every manual-testing bullet was re-verified against the code at b876490, not trusted as filed. Phase 3's 283 already-verified flow gaps (each with a live code trace, several walked against a booted server) are this phase's primary, freshest input and form the backbone of backlog.md. Nothing here is copied from a stale document without a fresh check — the phase-chain's own rule ("verify, don't copy") held throughout.