System shortfall register

Living backlog from the 2026-06-09 full-stack walkthrough. Severity: S1 crash/blocker · S2 broken feature · S3 UX/docs · S4 polish.

ID	Sev	Owner	Area	Issue	Status
S-001	—	supabase	Backend	whatsapp-ai-replay / whatsapp-reliability-action + api.whatsapp_reliability_incidents	verified deployed (walkthrough 2026-06-09)
S-002	—	mobile	Navigation	Web routes.ts drift vs mobile normalizer	mitigated — web_routes_parity_test.dart + snapshot in test/fixtures/
S-003	S3	mobile	Docs	CROSS_PLATFORM_PARITY.md comparables note stale	fixed in this walkthrough
S-004	S3	mobile	Docs	REMAINING_WORK.md §A body contradicted update table	fixed in this walkthrough
S-005	—	mobile	QA	Deferred /reports/* manual web sweep	mitigated — widget tests + route parity; manual spot-check optional
S-006	S2	mobile	E2E	Patrol tiers 02–03 still skip: true; Android Patrol runner not bootstrapped	mitigated — Tier 2.1–2.2 + Tier 3.1–3.2 un-skipped with widget keys; CI runs smoke_patrol_bundle_integration_test.dart (Tier 1+5); WhatsAppMockWebhookReplay added in integration_test/
S-007	—	ops	Mailbox	Four Hostinger accounts + on-device IMAP	verified on device (2026-06-09)
S-008	—	Flutter	Hermes	hermes-server model-pin read + AI gateway	fixed — canonical server, gateway, tests, lockfiles, health checks, and deploy workflow live in services/ + supabase/functions/ here
S-009	S1/S2	mobile/web	Auth	Long-lived tab gotrue refresh storm (F-004)	fixed — auth_refresh_guard.dart circuit-breaker, tab visibility pause, and unrecoverable token fail-closed guard eliminates gotrue refresh storms
S-010	—	Flutter	Repo	Edge Function deploy ownership	fixed — all 150 inventoried functions are local; the generated ownership manifest allowlists 145 deployable slugs and explicitly quarantines six legacy entries
S-011	S3	supabase	Security	Advisor WARN: anon/authenticated EXECUTE on some api.* SECURITY DEFINER RPCs	mitigated — 20260609150000_revoke_public_execute_catalog_rpc.sql applied live; anon/authenticated catalog + price-map RPCs unchanged
S-012	S3	supabase	Security	RLS-enabled tables without policies (backup/internal WhatsApp queue tables)	fixed — explicit service_role_all policies added via 20260915060000_s012_harden_internal_research_tables_rls.sql (Supabase linter 0008 count: 0)
S-013	S2	mobile	Tests	whatsapp_drip_repository_test / conversation ErrorState drift	fixed in this walkthrough
S-014	S2	mobile	Reports	Financial Reports (/reports/financial) stuck on loading spinner — its deals query selects deals.agent_name, a column that doesn't exist → PostgREST 400 → the fetch dies before it reaches invoices. Confirmed via live API logs (GET /rest/v1/deals?select=…agent_name… → 400) during 2026-06-22 device sweep.	fixed — fix/financial-report-deals-agent-name-400: drop agent_name from the select, resolve agent display names from profiles (mirrors deals_repository.dart). Cross-repo follow-up: confirm web useFinancialReportData.ts doesn't make the same select.
S-015	S4	mobile	Reports	Large KWD stat-card figures truncate with an ellipsis instead of scaling/wrapping (KPI "value brokered" → 16,390,00…; transaction-analytics "trading volume" → 217,225,787,931…).	fixed — wrapped the figure in FittedBox(scaleDown) on the KPI, transaction-analytics, and financial-report stat cards; the full number now shrinks to fit.
S-016	S4	mobile	AI	AI hub → quick-estimate (/ai/hub): the location field hint reused the area example ("مثال: 400"), and the condition dropdown placeholder read "اختر النوع" (choose type) instead of choose-condition.	fixed — added aiPricing.locationPlaceholder ("مثال: السالمية" / "e.g. Salmiya") and aiPricing.selectCondition ("اختر الحالة" / "Select condition") in both locales; wired the screen to them.
S-017	S3	mobile	Admin	Team/Users (/admin/users): role chips rendered raw English machine-keys (secretary_aldilaijan, hr_manager, whatsapp_agent, admin) in the Arabic UI.	fixed — added a staffRoles i18n namespace covering all 17 app_role enum values (en + ar); _RolePill now renders l.t('staffRoles.<role>').
S-018	S3	mobile	Analytics	Predictive Analytics (/transactions/predictive): every area card showed a raw i18n placeholder د.ك/م² حالياً — predict.currentPrice is rendered as a label (the value already prints below via _MiniTile) but the string embedded an un-interpolated .	fixed — label changed to "السعر الحالي" / "Current Price" in both locales.

S-014-class audit (2026-06-22) — Flutter Supabase query references a column/table absent from the live schema → PostgREST 400 → broken/empty screen. Found by an exhaustive 14-agent workflow cross-checking all 109 query-building files vs a live schema snapshot, each finding adversarially verified against the live DB (9 confirmed, 0 false-positive).

ID	Sev	Owner	Area	Issue	Status
S-019	S2	mobile	Revaluations	reminders_repository.create() inserts valuation_id — reminders has no such column; the revaluation-reminder caller always passes it → every "set reminder" tap 400s.	fixed — dropped the unstorable key + unused param (title already carries the valuation ref). If reminder→valuation linkage is wanted, add a valuation_id column.
S-020	S2	mobile	Reports	reports_repository.agentScorecards() selects/filters properties.agent_id; the column is assigned_broker_id. Future.wait fails the whole future → Agent Scorecards report never loads.	fixed — agent_id → assigned_broker_id (select + .not() + row read).
S-021	S2	mobile	Hermes	hermes_repository filtered .gte('started_at',…) (status KPIs) and .order('started_at') (recent runs) — hermes_agent_runs has no started_at (it's created_at).	fixed — both → created_at; recent-runs select aliases started_at:created_at so the model's start-time still populates (matches the 2026-05-26 runById fix).
S-022	S2	mobile	Follow-up	follow_up_repository today-appointments select referenced four non-existent appointments columns (system, description, deal_id, request_id) → todayAppointments() 400s (confirmed via live API logs after the first partial fix still 400'd).	fixed — select trimmed to real columns only; model dealId/requestId degrade to null. (Audit caught only system; the rest were found via on-device API-log verification.)
S-023	S2	mobile	Admin	audit_repository.get() embedded profiles!user_activity_logs_user_id_fkey(...) — there is no FK from user_activity_logs.user_id → profiles (it FKs auth.users), so PostgREST can't resolve the embed → audit-event detail 400s (and profiles.name was also wrong → display_name).	fixed — dropped the embed; resolve the actor profile in a second profiles lookup keyed on user_id (mirrors deals/reports). Column also corrected to display_name.
S-024	S2	mobile/supabase	Admin	Import-status dashboard queries moj_sync_log in the default (public) schema; the table lived only in internal (not exposed by PostgREST). Never returned rows.	fixed — migration 20260622220000_expose_internal_import_status_views.sql adds a staff-gated public.moj_sync_log view (definer + WHERE is_staff(auth.uid()), granted to authenticated only). Verified on-device: MOJ sync history populates. No Flutter change.
S-025	S3	mobile/supabase	Admin	Same as S-024 for paci_import_jobs (PACI import-jobs panel).	fixed — same migration adds public.paci_import_jobs view. Verified on-device (PACI batches + parcel estimate populate).
S-026	S2	mobile/supabase	Files	files_repository.recentActivity() queries file_activity_logs (with a file:files(...) embed) in public; table lived only in internal. Recent-activity panel couldn't load.	fixed — same migration adds public.file_activity_logs view; PostgREST resolves the files embed through it. Verified on-device (activity log shows file names).
S-027	S2	mobile	Search	Free-text area search returns nothing: properties.al_mintaqa and valuations.area store English area_keys (nuzha, salmiya…) post-migration, but property / valuation / global search ILIKE'd the raw Arabic/English area name against them → 0 hits (user reported "النزهة" missing all 84 Nuzha properties; confirmed live).	fixed — resolve the term via AreaCanon → area_key + stored forms, and add al_mintaqa/area ILIKE terms: applyPropertiesQueryFilters, valuations_repository.list (+ areaCanon threaded through valuationsListProvider), shared valuationSearchOrFilter, and global_search_screen (property + valuation). Follow-ups: requests search never queried al_manatiq (separate pre-existing gap) → S-028; web app likely has the same area-search bug.
S-028	S2	mobile	Search	Requests list search ignored the area entirely — requests_repository.list .or(...) matched only al_ism/al_raqam/tafasil, never al_manatiq (a text[] of English area_keys), so searching a request by area name returned 0.	fixed — resolve the term via AreaCanon.resolve and add an array-containment term al_manatiq.cs.{<area_key>} to the search .or() (exact element match → keep the raw snake_case key, no wildcard-strip); areaCanon threaded through requestsListProvider like valuations. DB-verified (cs nuzha→31, abu_fteira_suburb→3 requests).
S-029	S2	mobile	Transactions	MoJ transaction explorer governorate filter returned ~0 across all three screens (search, analytics, predictive): real_estate_transactions.governorate stores English machine keys (ahmadi, capital…) post-Stage-4, but the filter sheet emits Arabic short names (kMojGovernoratesAr), and the 7 RPCs (get_public_real_estate_transactions, get_transaction_stats/cat_distribution/area_prices/monthly_trend/yearly_comparison, get_area_monthly_ppm) all match governorate = <param> with no normalization. Same English-key bug class as S-027 but on the governorate facet of a different (MoJ-mirror) table.	fixed — resolve the selection to its key via governorateKey() before sending: transactions_repository.searchPublic (p_governorate), transaction_analytics_repository.fetch (gov across 5 RPCs), predictive_analytics_repository.fetchAreaMonthly (p_governorate); fixed the stale kMojGovernoratesAr comment claiming the table stores Arabic. Verified live (demo user): get_transaction_stats key=capital→14,505 vs Arabic→0; get_area_monthly_ppm key=ahmadi→1000 vs Arabic→6. (p_property_type/p_area/p_category left raw — those columns are still Arabic.)

Edge functions invoked by mobile (19)

Documented in test/core/navigation/edge_function_inventory_test.dart. All verified ACTIVE on project jrsgosnnyjonxaesqtln as of walkthrough date.

Navigation automation added

• test/fixtures/web_routes_snapshot.ts — pinned copy of web ROUTES
• test/core/navigation/web_routes_parity_test.dart
• test/core/navigation/notification_link_normalization_test.dart
• test/fixtures/notification_link_samples.json

Device QA (user execution)

Run docs/DEVICE_QA_CHECKLIST.md on TestFlight / Play Internal. Record results in checklist checkboxes or append rows here.