# 🧠 Project Brain — Joshen (جوشن) Backend

**The map of this project.** Start here to find any feature, its current
version, its integration doc, and where its updates are recorded.

| | |
|---|---|
| Product | Joshen (جوشن) — booking beauty and home personal-care services, Saudi Arabia. The BRD's working title is "Khadami". |
| Backend | Laravel 13 API (this repo) |
| Apps | Customer (Flutter) · Provider (Flutter) · Driver (Flutter) · Admin dashboard (React JS) |
| BRD in force | v1.3 (11/8/2026) — 95 features, 12 modules, + client decisions D1–D4 |
| Data model | [database/db-schema.sql](database/db-schema.sql) — 95 tables (17 base + 78 Joshen), MySQL 8; mapping to the base in [database/README.md](database/README.md) |
| Schema foundation | [database/README.md §6](database/README.md#6-implemented-schema-foundation-191) · 1.9.1 · implemented 2026-10-20: migrations, models, factories, seeders; data model guide now 2.3.0 (2026-11-04, TD-167 `in_app` delivery channel). Business features are tracked in the registry below. |
| Current phase | **BRD feature implementations are in place; WP-5 review fixes include the owner-defined provider today earnings.** Gateway fees and the other owner decisions and limitations remain open; see [DECISIONS.md](DECISIONS.md). |
| Brain last updated | **2026-11-11 (Flutter live re-check answered, not committed): demo providers/drivers now seeded with documents; `/health` documented; pre-pickup tracking left per TD-147 (6), owner decision open.** 2026-11-11 (QA round 2, not committed): 500 on array `change_type` fixed, locale-aware enum labels, 300 Arabic field labels + missing translation keys, TD-186; dashboard stale-chunk and raw-label findings recorded for the owners.** 2026-11-10 (QA close-out, not committed): `customer.user_id` added to admin payloads (orders, payments, cancellations, refunds, reviews, conversations), declined-payment message, Arabic validation labels, CORS env, Sara seed fix; TD-185; QA-09 awaits the owner.** 2026-11-10: R01–R03 built and tested (provider, delivery and admin `profile-change-requests` 1.0.0, status `ready`), NOT deployed; owner rules TD-184.** **2026-11-10: R01–R03 rules confirmed by the owner (TD-184, DEC-25 resolved); tracking values 30 km/h / 1.3 / 60 s confirmed; support hours still missing (R01–R03 are now built, see the entry before).** **2026-11-10: full QA report ([integration/2026-11-10-full-qa-report.md](integration/2026-11-10-full-qa-report.md)): 2 High (open Telescope, plain HTTP), 4 Medium (admin customer id, Postman URL, seed vs guide, stalls); dashboard UI and Flutter not covered.** **2026-11-10: post-seed live QA on staging: 33 scenario orders present, `Sample-` rows gone, 0 server errors across 174 GET reads, full scheduled lifecycle (create → accept → pay → chat → cancel → wallet refund) passes; [integration/qa-demo-accounts.md](integration/qa-demo-accounts.md) notes the 6 h seed windows. VAT registration number is empty (set before launch).** **2026-11-10: detour-factor range clarified in admin/settings.md (0.18.1); delivery fee rule Postman examples re-recorded with `avg_speed_kmh`.** **2026-11-10: R01–R03 proposal written (`integration/2026-11-10-reviewed-changes-r01-r03-proposal.md`: field matrix, stale-value check, atomic apply) — awaiting owner confirmation, nothing built.** **2026-11-09: R04–R08 contracts ready, not deployed (TD-183): driver ratings list, support video + `has_media`, live ETA / freshness, provider self-travel location, relay validation; R01–R03 approved, not built.** **2026-11-09: deferred mobile capabilities R01–R08 answered in `integration/2026-11-09-mobile-deferred-capabilities-reply.md` (TD-182, no API change, owner confirmation pending).** **2026-11-09: QA retest fixes (F3–F10): `rtrim` on the storage URL (double slash), generic message on writes that named none (API conventions 4.9.1), Postman examples no longer send fields a rule prohibits, driver accept replay and date-offset behaviour documented, 7 prototype screens mapped (joshan 1.0.1, orders 3.7.1, trip-requests 1.0.2, settings 0.17.1).** **2026-11-09: TD-181: bootstrap `data.contact` (hotline) shipped (API conventions 4.9.0); driver review history and reviewed profile/vehicle changes stay deferred and are recorded (BRD has no review list; DEC-25 open, TD-44).** **2026-11-09: TD-180 group booking (D2) is built: optional `people` on quote, create and slots, one delivery fee, summed duration, `group_booking_max_people` setting; client booking 2.3.0, orders 3.7.0, provider orders 2.7.0, provider-selection 2.1.0, admin settings 0.17.0; screens 04–06 added to the prototype index. Flutter closeout reply: [integration/2026-11-09-mobile-closeout-reply.md](integration/2026-11-09-mobile-closeout-reply.md); public page `slug` Postman metadata fixed.** **2026-11-08: TD-179 closes the admin dashboard gaps: support reason and assignee lookups (support 1.1.0), payment customer lookup by profile uuid (payments 1.1.0), `data.recipient_app` on admin pushes plus the Firebase operations runbook (notifications 1.4.0), featured expiry setting entry (settings 0.16.2) and PUT/PATCH plan clarification (featured-subscriptions 1.0.2); assignment now refuses non-signable admins.** **2026-11-08: TD-178 adds `filters[notification_reachable]` to the existing admin users/providers/drivers lists for general-notification picks; guides customers 2.2.0, providers 2.3.0, drivers 2.2.0 and notifications 1.3.0.** **2026-11-08: QA guide: the fresh driver offer example uses JSH-20007 (inside the execution window), pinned by a test. Earlier: seed fix: payouts follow TD-158 (one open request per beneficiary), the searching-trip offer stays live 6 h, cancellation rule looked up ([integration/qa-demo-accounts.md](integration/qa-demo-accounts.md)). Earlier: cycle-audit Phase 5 (TD-177): coherent demo seed (`CycleScenarioSeeder`) and the QA guide [integration/qa-demo-accounts.md](integration/qa-demo-accounts.md). Earlier: cycle-audit Phase 4: Postman gaps closed for service areas, content, admins, profile, feature flags, customer settings and media (baseline 354 → 116); `DELETE /media/{id}` 404 fix. Earlier: cycle-audit Phase 3 (TD-176): admin onboarding slides CRUD ([admin/content](admin/content.md) 0.3.0). Earlier: cycle-audit Phase 2 (TD-175): public static pages and FAQs on client, provider and delivery ([client/content](client/content.md), [provider/content](provider/content.md), [delivery/content](delivery/content.md) 1.0.0; auth and support guides 2.2.0 / 1.2.0). Earlier: cycle-audit Phase 1: stale "not built" statements corrected across 12 app guides (ratings, orders, featured, booking, transportation, permissions matrix; PATCH bumps). Earlier: TD-174: driver "requests near you" alert ([delivery/notifications](delivery/notifications.md) 1.5.0, `trips:alert-nearby-drivers` every minute, [admin/settings](admin/settings.md) 0.16.0 threshold + cooldown, 500→422 fix on notification settings) and retry of failed general notifications ([admin/notifications](admin/notifications.md) 1.2.0); [API_CONVENTIONS](API_CONVENTIONS.md) 4.8.0. Deploy: `migrate` → `rbac:sync-permissions`; the scheduler must run.** **2026-11-08: admin alerts, web push and general notifications (TD-173): [admin/notifications](admin/notifications.md) 1.1.0 (bell via the shared inbox, `POST /admin/auth/device`, Firebase web setup, `/admin/notifications/general`); app notification guides 1.4.0 (event `general`); [API_CONVENTIONS](API_CONVENTIONS.md) 4.7.0; data model 2.4.0. Deploy: `migrate` → `rbac:sync-permissions`; set `FIREBASE_ENABLED` + `FIREBASE_CREDENTIALS` and run a `notifications` queue worker.** **2026-11-08: WP-5 review follow-up (TD-172): [admin/settings](admin/settings.md) 0.15.2 restores the domain error codes (`INVALID_BOOKING_SETTINGS`, `JOSHEN_CONFIG_UNAVAILABLE`, …) and the standard 422 message; [delivery/home](delivery/home.md) 1.1.0 adds the overall `rating` and sums today's trip earnings exactly; [API_CONVENTIONS](API_CONVENTIONS.md) 4.6.0 records bootstrap `app.logo_url` as additive.** **2026-11-05: WP-5 review fixes and provider today earnings definition (TD-171).** **2026-11-05: provider and driver homes 1.0.0 and admin settings 0.15.0 (TD-169/170).** Earlier, 2026-11-05: final docs review; [admin/settings](admin/settings.md) 0.14.1 (unknown setting key is 422, not 500; §13 lists the remaining ADMIN-025 gaps: logo, gateway fees). Sprint sheet: every Backend row ticked (row 60 after WP-4). Remaining BRD work: PROV-006 / DRIV-005 home pages (WP-5). Earlier: 2026-11-04 (docs audit): every guide re-checked against the registry and CHANGELOG. [API_CONVENTIONS](API_CONVENTIONS.md) 4.5.0 (§3.2.1 every error code; §7.1 catalog with the WP-4 events); notification guides 1.3.1 (inactive templates keep inbox history, ISO `scheduled_at`); provider packages 1.0.1; data model guide 2.3.0; §5/§7 refreshed. Earlier: 2026-11-04 (audit): **BRD gap sweep.** [admin/payments](admin/payments.md) 1.0.0 (ADMIN-015 payments monitor: list, filters, details; read-only), payment-method switches (ADMIN-025) with [client/payment](client/payment.md) 1.1.0 `GET /payment-methods`, settings 0.14.0, provider featured 1.2.0 (TD-168). Fix: switching a notification template off no longer hides past inbox rows. Deploy: `migrate` → `rbac:sync-permissions`. Earlier: 2026-11-04: **Notification engine, missing BRD triggers, and reminders completed (WP-4; ADMIN-020, ADMIN-025, CUST-022, PROV-025, DRIV-018, TD-167).** [admin/notifications](admin/notifications.md) 1.0.0; [client/notifications](client/notifications.md) 1.3.0, [provider/notifications](provider/notifications.md) 1.3.0, [delivery/notifications](delivery/notifications.md) 1.3.0; [admin/settings](admin/settings.md) 0.13.0. Deploy: `migrate` → `php artisan rbac:sync-permissions`. Earlier: 2026-11-04: **Flutter handoff B01–B07 closed (branch `feat/flutter-handoff-b01-b07`, TD-166, DEC-28, DEC-29).** Built: per-category notification switches for the three apps (`GET`/`PUT …/notifications/preferences/categories`; [client](client/notifications.md), [provider](provider/notifications.md), [delivery](delivery/notifications.md) 1.1.0, still `partial`); the push sender now filters every category, not only chat. Docs: [API_CONVENTIONS](API_CONVENTIONS.md) 4.4.0 (§7.1 event catalog, §7.2 device lifecycle, §7.3 preferences, §9 recipient fixes); [client/wallet](client/wallet.md) 1.0.1 (ledger semantics); [client/payment](client/payment.md) 1.0.1 and [provider/featured-subscription](provider/featured-subscription.md) 1.1.1 (staging payment-simulator QA path). Reply and DevOps runbook: [integration/2026-11-04-flutter-handoff-reply.md](integration/2026-11-04-flutter-handoff-reply.md). Docs MCP showing wallet as planned = staging runs a checkout older than 2026-11-03; redeploy from `main`. Earlier: 2026-11-03: **Tax invoices & receipts and ZATCA Phase-1 QR (sheet row 58; CUST-015, PROV-007, ADMIN-013, ADMIN-025, TD-165).** [client/payment](client/payment.md) 1.0.0; [provider/featured-subscription](provider/featured-subscription.md) 1.1.0, [admin/orders](admin/orders.md) 2.4.0, [admin/settings](admin/settings.md) 0.12.0. Deploy: migrate, then run invoices:backfill if existing payments lack invoices. Launch blocker: configure vat_seller_name and vat_registration_number. Earlier: 2026-11-03: **Customer wallet and full wallet payment (CUST-015/016, TD-164, sheet row 57).** [client/wallet](client/wallet.md) 1.0.0; booking 2.2.0, my-packages 1.1.0, admin customers 2.1.0 and settings 0.11.0. Deploy: migrate. Earlier: 2026-11-03: **Driver support and the admin support desk built (sheet row 68; DRIV-019, ADMIN-026).** [delivery/support](delivery/support.md) 1.0.0 (same five routes as the other apps, open in every account status, optional own `trip_id`, default driver reasons by migration); [admin/support](admin/support.md) 1.0.0 (additive: `/admin/support-tickets` list, details, reply, status, close, assign; the requester gets `support_ticket_replied` / `support_ticket_status_changed`; TD-163 keeps `/admin/contact-messages` and `/client/contact` working, marked deprecated); [client/support](client/support.md) and [provider/support](provider/support.md) 1.1.0 (notifications, `trip` key). Deploy: `migrate` → `php artisan rbac:sync-permissions` (roles with `support.*` cells gain the desk routes). Standing rule: changes are additive only — never remove or rename a route, route name, request field, response key or enum value; if it cannot be additive, ask. Earlier: 2026-11-03: **Full docs audit.** Registry rows re-synced to the docs (client/booking 2.1.0, provider/profile 1.2.2, delivery/profile 1.0.2, delivery/trips 1.1.1, admin/settings 0.10.0); two docs' `last_updated` front matter aligned with their registry date; §5 settings and dashboard rows, "Current phase" and §7 blocking decisions updated for DEC-08/10/11 and TD-161; the four surface READMEs now list every guide (no per-version text, so they cannot drift). Checks: every doc link resolves, 397 of 398 API routes appear in a doc (only legacy `POST /client/upload` does not), Postman `--check` OK. Sprint tracker status: [sprints/Joshen.xlsx](sprints/Joshen.xlsx). Earlier: 2026-11-03: **Socket relay on port 5071** ([API_CONVENTIONS](API_CONVENTIONS.md) 4.3.2 §9: staging `REALTIME_URL` `https://joshen-back.elkady.aait-d.com:5071`, deploy notes incl. full-chain TLS). Staging verified live: customer ↔ provider chat events delivered over the socket with TLS verification on. 2026-11-02: **Chat and live tracking released as `ready` after a review against code and tests (427 PHP + 22 socket tests pass, Postman `--check` OK).** [client/chat](client/chat.md) and [provider/chat](provider/chat.md) 3.0.1 (contract unchanged; error tables; provider also gets the `chat_message` alert; DEC-14 open part is retention only), [client/orders](client/orders.md) 3.6.2 (new §3.4 live tracking preview: `transport.stage` values, `tracking-subscription`, socket ack errors; stale notes removed; two Postman examples re-recorded), [delivery/trip-execution](delivery/trip-execution.md) 1.3.2 (location endpoint section, status table, earning `available` wording), [provider/orders](provider/orders.md) registry → ready, [API_CONVENTIONS](API_CONVENTIONS.md) 4.3.1 (trip event `status` is a plain string). The registry rows had drifted from the docs (client/orders listed 3.5.0). Still open, none of them blocking the contract: DEC-14 retention, DEC-27 calls, DEC-07 driver no-show, TD-147 stale-location / ETA / self-travel position. Earlier: 2026-11-02: **Rating cycle and support tickets built (sheet rows 65–66; CUST-021, PROV-024, CUST-024, PROV-026).** [client/ratings](client/ratings.md) and [provider/ratings](provider/ratings.md) 1.0.0: `POST …/orders/{order}/rating` (one per order per direction, 409 after; provider-only private note never returned), `GET …/review-tags`, `GET /provider/ratings` (visible ratings + summary equal to her profile average; hidden ones vanish); [client/support](client/support.md) and [provider/support](provider/support.md) 1.0.0: reasons, tickets with thread, follow-ups, typed `SUPPORT_*` / `REVIEW_*` errors (TD-162). Deploy: `migrate` (seeds default support reasons and rating tags where none exist). The admin ticket desk (ADMIN-026) is not built, so `replied` / `closed` are set outside the API for now. Earlier: 2026-11-02: **Sprint 3 dashboard finished.** [admin/commissions](admin/commissions.md) 1.0.0 (TD-159: commission rules with start dates, rule in force never edited, provider percent only); [admin/ratings](admin/ratings.md) 1.0.0 (TD-160: publish / hide, hidden ratings leave averages, no delete); [admin/reports](admin/reports.md) 1.0.0 and [admin/dashboard](admin/dashboard.md) 1.0.0 MAJOR (TD-161: one figure definition for both; DEC-20 partly resolved). Earlier: 2026-11-02: **Provider and driver amounts due and manual payouts built (PROV-023, DRIV-017, ADMIN-017).** [provider/earnings](provider/earnings.md) and [delivery/earnings](delivery/earnings.md) 1.0.0: `GET /earnings` (totals + every amount due), `GET /payouts`, `POST /payouts` (claims all `available` earnings in one locked transaction; typed `PAYOUT_*` errors); [admin/payouts](admin/payouts.md) 1.0.0: request desk per role, audited full-IBAN read (`payouts.approve`), `processing` / `paid` / `cancel` (optional `reject_account`) / `fail`, per-beneficiary balances; [admin/settings](admin/settings.md) 0.10.0 adds `payout_min_amount`. **DEC-11 answered (TD-158):** an earning is `available` at once (provider: at service completion; driver: at arrival confirmation, so [delivery/trip-execution](delivery/trip-execution.md) 1.3.1 now shows `available`); one open request; the featured-plan deduction is netted; a transfer proves a `pending` account, and a `rejected` account can be replaced ([provider/profile](provider/profile.md) 1.2.2, [delivery/profile](delivery/profile.md) 1.0.2). Deploy: `migrate` → `php artisan rbac:sync-permissions` → grant `payouts.view` / `payouts.approve`; orders completed before this release have no provider earning. Earlier 2026-11-01: **Cancellation and refund management built (ADMIN-018, PROV-016).** [admin/cancellations-refunds](admin/cancellations-refunds.md) 1.0.0: cancellation-rule CRUD, read-only cancellations monitor, refunds list/detail, admin refund to the wallet and retry of failed refunds (`cancellations_refunds` section); [provider/cancellation](provider/cancellation.md) 1.0.0: `POST /orders/{order}/cancel` with a full wallet refund and `can_cancel`; [client/orders](client/orders.md) 3.6.0 and [client/cancellation](client/cancellation.md) 1.2.0 add `cancellation.cancelled_by`; [API_CONVENTIONS](API_CONVENTIONS.md) 4.2.0 lists three new error codes. **DEC-10 answered "wallet only" (TD-152). Follow-up 2026-11-02 (`fix/wallet-only-refunds`): a wallet refund never calls the payment gateway and is always `completed`; the admin retry route is removed and `POST /admin/refunds` requires an `Idempotency-Key` ([admin/cancellations-refunds](admin/cancellations-refunds.md) 2.0.0, MAJOR; TD-156, TD-157).** Every cancellation settles its trip and reverses earnings (TD-155): a completed trip keeps the driver's pending earning only when the rule kept the delivery fee. Deploy: `migrate` (seeds the provider policy) → `db:seed --class=PermissionSeeder`/`php artisan rbac:sync-permissions`. Earlier 2026-11-01: **Driver arrival confirmation and admin chat monitor.** DEC-08 resolved (TD-149): driver, provider or customer confirms an arrived trip via `confirm-arrival`; the first completes it and writes the driver's pending earning (delivery fee − driver commission); starting the service confirms implicitly ([delivery/trip-execution](delivery/trip-execution.md) 1.3.0, [provider/order-execution](provider/order-execution.md) 1.3.0, [client/orders](client/orders.md) 3.5.0). DEC-14 partly resolved (TD-150): read-only, audited `GET /admin/conversations[/{conversation}]` ([admin/orders](admin/orders.md) 2.3.0). TD-151: SAR is the only currency; the real gateway stays deferred. Earlier 2026-11-01: **`GET /admin/permissions` regrouped by section title** ([admin/admins-permissions](admin/admins-permissions.md) 3.0.0, MAJOR): items carry `back_route_name`, `front_route_name` and `icon` from `config/rbac.php`; old dictionary at `?format=dictionary`. The same shape now answers `profile.permissions` (login, me, refresh, profile) and `auth/my-permissions` ([admin/auth](admin/auth.md) 4.0.0, MAJOR). Earlier 2026-11-01: **Coupons built (ADMIN-015/016, CUST-011/014).** [admin/coupons](admin/coupons.md) 1.0.0: CRUD with scope (all / category / service / provider, uuid targets), limits, dates and a paginated redemption history; [client/booking](client/booking.md) 2.1.0 adds `coupon_code` on quote and create, the shared `coupon` object and six `COUPON_*` errors; [client/orders](client/orders.md) 3.4.0 and [admin/orders](admin/orders.md) 2.2.0 return the coupon; [API_CONVENTIONS](API_CONVENTIONS.md) 4.1.0 lists the codes. **TD-148 (scope, usage counting and release, half-up rounding, free-order refusal `COUPON_FREE_ORDER`) is a working assumption awaiting owner confirmation**; provider-funded coupons stay unused (DEC-09). Earlier 2026-11-01: **QA handoff 2026-10-31 triaged.** B03 fixed: `GET /client/governorates|regions` honour `filters[country_id|governorate_id]` (the documented form; the service read only flat names) — `GeoRoutesTest`. B01 (auth 500) and B02 (docs MCP 500) no longer reproduce on staging (all three `auth/login` return a challenge, MCP tools answer); root cause needs the server logs for the reported correlation IDs. B04 simulator refusal is env-driven (`PAYMENT_SIMULATOR_ENABLED` / `APP_ENV`, TD-130); B05/B06 await product/Postman capture. Earlier 2026-11-01: **Review fixes on the realtime branch (TD-147):** every tracked order transition publishes `order.tracking.stage` (repeats possible), an availability ping during a live trip publishes the driver location, chat sends are rate limited, chat `status` / `sender_role` / `type` are `{value,label}` ([client/chat](client/chat.md) and [provider/chat](provider/chat.md) 3.0.0, [API_CONVENTIONS](API_CONVENTIONS.md) 4.0.0), history reads never create a conversation, the grant lifetime is `REALTIME_GRANT_TTL_SECONDS` and a missing `REALTIME_GRANT_SECRET` answers a typed 503. Stale-location threshold, ETA/distance, live map, DEC-07/08/14/26/27 remain open. Earlier 2026-10-29: Realtime order tracking and paid participant chat implementation in progress (TD-144–146); chat pagination and role-specific unread are locally verified, while DEC-14 retention and mobile integration remain open. Earlier 2026-10-28: **FCM push notifications and device integration hardened across mobile surfaces (TD-141..143).** [client/notifications](client/notifications.md), [provider/notifications](provider/notifications.md), and [delivery/notifications](delivery/notifications.md) 1.0.0 are partial: device token registration, shared inbox, and FCM push of persisted notifications are built; the notification preferences UI contract and complete event catalog are not built. Earlier 2026-10-28: Cycle F guides cover provider transport, driver dispatch and trip execution; DRIV-015 remains blocked on DEC-08. Previously 2026-10-27: **Dispatch rate limits are dashboard-editable in [admin/settings](admin/settings.md) 0.8.0 (TD-133); client confirmation pending.** Previously 2026-10-27: **Sprint 2 cycle E complete (TD-123…128): prepaid package purchase and session booking. [client/my-packages.md](client/my-packages.md) 1.0.0 is ready — all Postman examples recorded, full-suite 1178 passed.** Previously: 2026-10-27: **`auth/my-permissions` returns the full grants to a super admin and `permissions` is the `{resource: [actions]}` dictionary ([admin/auth](admin/auth.md) 3.0.0, TD-121); finder in-memory pagination logged as TD-122.** Previously, 2026-10-26: **Joshen guided search built (CUST-009 + ADMIN-012, Sprint 2 cycle D).** [client/joshan](client/joshan.md) 1.0.0 adds config-first guest/customer search, shared eligibility and post-filter featured ranking, one search log across pages, and normal order conversion; [admin/joshan](admin/joshan.md) 1.0.0 adds config, occasion/service tagging and read-only search/conversion monitoring (TD-114…120). [client/orders](client/orders.md) 2.5.0 adds source/search linkage, [admin/services](admin/services.md) 2.1.0 adds type-1 occasion tagging, [admin/settings](admin/settings.md) 0.6.0 validates Joshen settings on the generic writer, and [API_CONVENTIONS](API_CONVENTIONS.md) 2.12.0 documents `X-Guest-Device-ID`. Before that — 2026-10-26: **Order delay alerts and admin order monitor built (ADMIN-013 + CUST-019 delay, Sprint 2 cycle C).** New [admin/orders](admin/orders.md) 1.0.0: read-only `GET /admin/orders` + `/{order}` (section `orders`) with filters (status, booking type, payment status, kind, provider/customer/city uuids, `created_*` and `scheduled_*` date ranges, `delayed`), search by code, sorts, the full status history **with actors**, payments, notification history, refunds and `is_delayed`; no admin action changes an order, `driver`/`dispatch` stay null until cycle F, chat stays deferred (TD-112). `orders:alert-delays` (every minute) alerts the customer once per stage when the provider's update is overdue (per-stage deadlines TD-109, settings `order_status_delay_minutes` 15 / `scheduled_delay_clock_lead_minutes` 60 **awaiting client confirmation** TD-110, cadence TD-111): inbox row `order_delayed` + `order.updated` `reason: delayed` ([API_CONVENTIONS](API_CONVENTIONS.md) 2.11.0), never a status change, reassignment or cancellation. [client/orders](client/orders.md) 2.4.0 adds `delay_alert`; [admin/settings](admin/settings.md) 0.5.0 adds the two settings and a migration that inserts missing booking rows (`execution_early_start_minutes` too); [provider/order-execution](provider/order-execution.md) 1.0.1 explains the alert. TD-113 records the customer key. Before that — 2026-10-26: **Geo 500 fixed and 422 docs corrected.** `GET /client/countries|governorates|regions` (and every route behind `geo.context`) returned 500 because the `GeoContext` constructor was private while the header, profile and IP resolvers built it; it is public now and `GeoRoutesTest` covers all three resolvers. Validation-422 examples that still showed `data: null` now show `data.errors` (TD-02) in client/addresses 1.0.1, client/home 1.0.1, client/catalog 1.1.1, provider/onboarding 1.0.3, provider/profile 1.2.1, delivery/onboarding 1.0.1, delivery/profile 1.0.1, admin/customers 2.0.1, admin/drivers 2.1.1, admin/providers 2.2.1 [API_CONVENTIONS](API_CONVENTIONS.md) 2.10.2 documents validation correlation IDs in the `X-Correlation-ID` header (TD-107) and generic 5xx messages outside local development (TD-108); staging and production debug settings cannot expose exception text. Before that — 2026-10-26: **Customer order cancellation built (CUST-020, Sprint 2 cycle B).** [client/cancellation](client/cancellation.md) 1.0.0 adds `POST /orders/{order}/cancel`, DEC-24 production default rules, full wallet refunds before execution, typed lock/policy errors, provider/customer inbox and live `cancelled` events. [client/orders](client/orders.md) 2.3.0 makes `can_cancel` real and adds stable cancellation details; [provider/orders](provider/orders.md) 2.2.0 adds the cancelled tab; [API_CONVENTIONS](API_CONVENTIONS.md) 2.10.0 updates §9.1. TD-105/106 record the default/window and fee boundaries. Before that — 2026-10-26: **Provider order execution built (PROV-019/020, CUST-019 result, BR-19/22/23/28).** New [provider/order-execution](provider/order-execution.md) 1.0.0: `POST /orders/{order}/status` (body `status` = `preparing|on_the_way|arrived|in_progress|completed`) moves her own confirmed order through the shared `AdvanceOrderAction` (repeat = 200 no-op checked first), guarded by `OrderExecutionGate` with dedicated 422 codes `ORDER_NOT_EXECUTABLE`, `INVALID_STATE_TRANSITION`, `ORDER_STAGE_MANAGED_BY_DRIVER` (Joshen-driver orders: departure comes from the driver trip, she keeps arrival/start/complete) and `ORDER_EXECUTION_TOO_EARLY` (scheduled start window `execution_early_start_minutes`, default 120, awaiting client confirmation, TD-101…104). [provider/orders](provider/orders.md) 2.1.0 and [client/orders](client/orders.md) 2.2.0 (both MINOR) add always-present `can_*` flags incl. `can_rate` per direction (BR-28; **the apps must not show Rate yet**, CUST-021 / PROV-024 are Phase 4); the provider `completed` tab is filled; [admin/settings](admin/settings.md) 0.4.0 lists the new key. **Production orders can now leave `confirmed`** (self travel); the driver-trip departure is cycle F and `DriverTripHasArrived` is a pass-through hook (DEC-08 Open). Completion writes **no earning** (Sprint 3). Run `db:seed --class=AppConfigSeeder` on existing databases. Before that — 2026-10-26: **Customer order tracking built (CUST-017, BR-22).** [client/orders](client/orders.md) 2.1.0 (MINOR): `GET /orders?tab=current|upcoming|completed|cancelled`, richer list tile (service, address), a status `timeline` without the actor, `refund` follow-up (`returned_to_wallet`), the execution statuses `preparing → on_the_way → arrived → in_progress → completed`, and a live `order.updated` (`status_changed`) per stage ([API_CONVENTIONS](API_CONVENTIONS.md) 2.9.0, TD-100). The shared `AdvanceOrderAction` applies a stage whoever (provider or driver) contributed it, so the customer sees one status; **no endpoint calls it yet** (PROV-019/020 and the driver trip flow), so a production order still stops at `confirmed`. `can_cancel` / `can_chat` stay false. Booking tests no longer depend on the demo commission seed (the seeder moved to 15%). Before that — 2026-10-25: **Banners built (ADMIN-023).** [admin/banners](admin/banners.md) 1.0.0 (MAJOR): `{ar, en}` text with badge, `target_app` + `placement`, `link_type` + `link` (uuid / route / URL, TD-99), display dates, required image that is now really attached; the customer home already filtered by these (BR-30), the provider and driver apps still have no banner endpoint. Before that — 2026-10-25: **Featured subscription built (PROV-007 + ADMIN-005, MOD-09).** [provider/featured-subscription](provider/featured-subscription.md) and [admin/featured-subscriptions](admin/featured-subscriptions.md) 1.0.1 (each ends with a done / not-done requirement table; open: expiry-soon and admin notices, structured benefits, saved cards, payout netting, end-to-end ranking test): several plans with VAT, pay by saved card / card / Apple Pay / earnings deduction, dated priority that `v_provider_featured` already feeds into search ranking (BR-09/27), failed payments recorded and retryable, expiry by `featured:expire` (every minute) and lazily on read, admin plan CRUD + subscriber/payment monitor (TD-98). **Launch blockers added:** card/mada/Apple Pay still run on the simulator (TD-94, DEC-06) and `auto_renew` does not charge yet; refunds/suspension (DEC-12) and the customer "Featured" label (DEC-23) stay open. Before that — 2026-10-25: **Phase 2 order cycle hardened and live.** Order events now reach the apps over Socket.IO (`order.requested` / `order.updated`, per-app private rooms, [API_CONVENTIONS](API_CONVENTIONS.md) 2.8.0 §9, TD-96); each deadline fires its own delayed job; stored body-checked idempotency + short `JSH-` codes (TD-95); per-user order throttles (TD-97); arrival-aware overlap; provider order contract now `{value,label}` + `payment_status` + `can_respond` with the address hidden after rejection ([provider/orders](provider/orders.md), [client/orders](client/orders.md), [client/booking](client/booking.md), [client/provider-selection](client/provider-selection.md) all 2.0.0 — MAJOR). `ecosystem.yml` runs `Joshen Scheduler` and `Joshen Socket`. **Launch blockers:** FCM push for these events, the simulated gateway (TD-94), plus the earlier list. Before that — **Phase 2 order cycle v1 built (scoped).** [client/provider-selection](client/provider-selection.md), [client/booking](client/booking.md), [client/orders](client/orders.md), [provider/availability](provider/availability.md) and [provider/orders](provider/orders.md) 1.0.0 cover provider selection, quote, booking, payment, provider decision, expiry/refund, and status polling (TD-92/93/94). The simulator and production push delivery are launch blockers; DEC-04/05/06 remain partly resolved. Earlier Phase 1 history: [CHANGELOG.md](CHANGELOG.md). |

---

## 1. How to use this file

**To find what changed in a feature:** find it in the [registry](#4-feature-registry)
→ open its doc → read *Version history* (summary) and *Changelog* (details).

**To see everything that changed recently:** [CHANGELOG.md](CHANGELOG.md) (newest first).

**To know why something behaves the way it does:** the feature doc's BRD IDs →
[Project Guide](brd/BRD-Khadami-Project-Guide-en.md) → [DECISIONS.md](DECISIONS.md).

**Before building a feature (agents):**
1. Find its row below. Use the reserved doc slug — do not invent a new one.
2. Read its BRD IDs in the Project Guide (link: `brd/BRD-Khadami-Project-Guide-en.md#cust-012`, lowercase ID).
3. Check D1–D4 and the DEC-xx it depends on in [DECISIONS.md](DECISIONS.md).
4. Find its tables in [database/README.md §2.2](database/README.md#22-follows-the-schema-business-domain) and read them in `db-schema.sql`.
5. Check the [existing base code](#5-existing-base-code-pre-brd) — reuse identity/geo/RBAC, replace superseded tables.
6. Look at its screens: the **Screens** column lists file patterns in
   `docs/Joshen_screens_by_feature/` — open only those images.
7. Build following `.kiro/steering/*`, then write the doc and update this registry
   + `CHANGELOG.md` (rules: `.kiro/steering/feature-documentation.md`).
8. Leave the Postman collection complete for every touched route: key docs +
   captured examples, `php artisan postman:generate --check` green (TD-56).

### Reading budget (save tokens)

Start here, then open **only the slice you need**. Never read the big files
end to end.

| Source | Size | Read only | How |
|--------|------|-----------|-----|
| This file | ~250 lines | The feature's registry row + §5 row | — |
| Feature doc `docs/{surface}/{slug}.md` | 1 feature | Whole file — it is the feature's memory (contract, versions, decisions) | Prefer it over BRD, schema, and code when it exists |
| `brd/BRD-Khadami-Project-Guide-en.md` | ~3,700 lines | The feature's section (~30 lines per ID) | `grep -n 'id="cust-012"' docs/brd/BRD-Khadami-Project-Guide-en.md`, read ~40 lines from there |
| `database/db-schema.sql` | ~1,900 lines | The tables in the feature's doc / §2.2 of the database README | `grep -n "CREATE TABLE orders" docs/database/db-schema.sql`, read to the closing `);` |
| `DECISIONS.md` | ~200 lines | The D/DEC/TD rows the feature cites | `grep -n "DEC-05\|D3 " docs/DECISIONS.md` |
| `Joshen_screens_by_feature/` | 125 images | The files matching the row's Screens pattern | `ls docs/Joshen_screens_by_feature/customer--booking--0[3-6]*` — images are the most expensive input |
| `.kiro/steering/*.md` | ~1,100 lines | Files listed for the task in `AGENTS.md` → Task routing | Claude Code already has them loaded |
| Arabic BRD / source conversions | ~2,800–3,700 lines | Only when the English guide is ambiguous | Same anchors as the English guide |

Once a feature doc exists, an agent changing that feature should need only:
**this row → the feature doc → the code files it names**.

## 2. Surfaces

| Surface | App | Tech | Docs | Routes | URL prefix |
|---------|-----|------|------|--------|-----------|
| `admin` | Admin dashboard | React JS | [docs/admin/](admin/README.md) | `routes/api/v1/admin.php` | `/api/v1/admin/` |
| `client` | Customer app | Flutter | [docs/client/](client/README.md) | `routes/api/v1/client.php`, `guest.php` | `/api/v1/client/` |
| `provider` | Service provider app | Flutter | [docs/provider/](provider/README.md) | `routes/api/v1/provider.php` | `/api/v1/provider/` |
| `delivery` | Driver app | Flutter | [docs/delivery/](delivery/README.md) | `routes/api/v1/delivery.php` | `/api/v1/delivery/` |
| `shared` | All | — | [API_CONVENTIONS.md](API_CONVENTIONS.md) | `routes/api/v1/shared.php` | `/api/v1/` |

## 3. Document map

| File | Purpose |
|------|---------|
| [PROJECT_BRAIN.md](PROJECT_BRAIN.md) | This map |
| [CHANGELOG.md](CHANGELOG.md) | Timeline of every feature version |
| [DECISIONS.md](DECISIONS.md) | Client decisions (D1–D4), BRD decisions (DEC-xx), technical decisions (TD-xx) |
| [database/db-schema.sql](database/db-schema.sql) | **Target data model** (tables, statuses, constraints, triggers, views) |
| [database/README.md](database/README.md) | How the schema maps onto the Laravel base, schema conventions, status vocabulary |
| [integration/2026-11-09-mobile-closeout-reply.md](integration/2026-11-09-mobile-closeout-reply.md) | Backend reply to the Flutter closeout: group booking (TD-180), deferred scopes (TD-181), deployment gates |
| [integration/2026-11-09-mobile-deferred-capabilities-reply.md](integration/2026-11-09-mobile-deferred-capabilities-reply.md) | Disposition of deferred mobile capabilities R01–R08 (TD-182): none ready, owner decisions listed |
| [integration/2026-11-10-reviewed-changes-r01-r03-proposal.md](integration/2026-11-10-reviewed-changes-r01-r03-proposal.md) | PROPOSAL for reviewed profile / vehicle / document changes (R01–R03, TD-44): field matrix, lifecycle, stale-value check, atomic apply; owner questions |
| [integration/qa-demo-accounts.md](integration/qa-demo-accounts.md) | QA: seeded phones and admin logins, OTP `1234`, and which account / order code to open for each booking cycle (local, dev and testing only) |
| [qa/FULL_QA_REPORT.md](qa/FULL_QA_REPORT.md) | Full QA of 2026-11-10 with remediation (section 7): bug register, coverage matrix, business cycles, backend and dashboard reports (`docs/qa/`) |
| [../socket-io/CHAT_ARCHITECTURE.md](../socket-io/CHAT_ARCHITECTURE.md) | Legacy shared-service architecture document for another project; Joshen's current Socket.IO contracts are in [API_CONVENTIONS §9](API_CONVENTIONS.md). Order events use private app rooms (TD-96); persisted order chat uses TD-144/145. |
| [API_CONVENTIONS.md](API_CONVENTIONS.md) | Envelope, errors, pagination, headers, Flutter (Dio) + React (axios/TS) setup, docs MCP server for coding agents (§8, TD-31) |
| [MCP_AGENT_GUIDE.md](MCP_AGENT_GUIDE.md) | Connect a Flutter/React coding agent to the `joshen-docs` MCP server; mandatory reading order (BRD, this file, decisions, app docs); rules block for app repos (TD-31); reading `get-endpoint` field docs, real examples and call-flow `variables` (TD-56/57) |
| [_templates/feature-flutter.md](_templates/feature-flutter.md) | Template for client / provider / delivery feature docs |
| [_templates/feature-react.md](_templates/feature-react.md) | Template for admin feature docs |
| [brd/BRD-Khadami-Project-Guide-en.md](brd/BRD-Khadami-Project-Guide-en.md) | **Working BRD** (guide 1.1): features, workflows, rules, lifecycles, acceptance; §17 = screen vs BRD differences (`SCR-xx`) |
| [Joshen_screens_by_feature/SCREENS_INDEX.md](Joshen_screens_by_feature/SCREENS_INDEX.md) | Prototype screenshots per app and feature (125); differences from the BRD are in guide §17 |
| [brd/BRD-Khadami-en.md](brd/BRD-Khadami-en.md) | Source BRD conversion (English) |
| [brd/BRD-Khadami-Project-Guide-ar.md](brd/BRD-Khadami-Project-Guide-ar.md) · [brd/BRD-Khadami-ar.md](brd/BRD-Khadami-ar.md) | Arabic versions |
| [ARCHITECTURE.md](ARCHITECTURE.md) | Base backend architecture (layers, pipeline, RBAC, cache…) |
| [postman/README.md](postman/README.md) | How `postman-collection.json` stores payload docs and captured examples (TD-81), and the shrinking coverage baseline (TD-56) |
| `.kiro/steering/*.md` | Coding rules for agents (always loaded) |

## 4. Feature registry

**Status:** `planned` → `in-progress` → `ready` (backend done, doc published,
ready for app integration) · `deferred` (postponed by a decision) · `deprecated` ·
`base (TD-32)` (only the pre-BRD base endpoints exist; doc at 0.x records what they
do today, including failures — the BRD feature is still to build).
**Doc:** a plain path means *reserved, not written yet*; it becomes a link when the doc exists.
**Phase:** delivery phase from [§6](#6-delivery-phases).
**Screens:** filename patterns in [`Joshen_screens_by_feature/`](Joshen_screens_by_feature/SCREENS_INDEX.md)
(count in brackets). All 125 prototype screens are mapped. The admin dashboard
has no prototype; driver trip execution, trip history, earnings, profile, and
support are not captured yet.

### 4.1 Client — Customer app (Flutter)

| Doc | Feature | BRD IDs | Module | Phase | Status | Version | Updated | Screens |
|-----|---------|---------|--------|-------|--------|---------|---------|---------|
| [client/auth.md](client/auth.md) | Guest access, registration & login (phone + SMS OTP, no password) | CUST-001, CUST-002, CUST-003 | MOD-01, MOD-03 | 1 | ready | 2.2.0 | 2026-11-08 | `customer--auth--*` (5) |
| [client/profile.md](client/profile.md) | Profile & mobile number change | CUST-023 | MOD-01 | 1 | ready | 1.0.2 | 2026-11-08 | `customer--account--0[1-3]-*` (3) |
| [client/addresses.md](client/addresses.md) | Service addresses | CUST-004 | MOD-03 | 2 | ready | 1.0.1 | 2026-10-26 | `customer--account--04-*` (1) |
| [client/home.md](client/home.md) | Home page | CUST-005 | MOD-03 | 2 | ready | 1.0.1 | 2026-10-26 | `customer--home--*`, `customer--onboarding--*` (7) |
| [client/catalog.md](client/catalog.md) | Service listing, service details, packages (listing, details and purchase; see my-packages) | CUST-006, CUST-007, CUST-008 | MOD-02 | 2 | ready (scoped TD-78/79) | 1.2.0 | 2026-10-27 | `customer--catalog--*`, `customer--search--*`, `customer--packages--01-*`, `customer--packages--02-details-p1*` (9) |
| [client/joshan.md](client/joshan.md) | Joshan guided search | CUST-009 | MOD-03 | 2 | ready | 1.0.1 | 2026-11-09 | `customer--search--*`, `customer--joshen-finder--*` (5) |
| [client/provider-selection.md](client/provider-selection.md) | Provider selection & price calculation | CUST-010, CUST-011 | MOD-03, MOD-05 | 2 | ready | 2.1.0 | 2026-11-09 | `customer--booking--01-*`, `customer--booking--02-*`, `customer--provider-profile--*` (7) |
| [client/booking.md](client/booking.md) | Instant & scheduled booking, order summary | CUST-012, CUST-013, CUST-014 | MOD-05 | 2 | ready | 2.3.0 | 2026-11-09 | `customer--booking--0[3-6]*`, `customer--group-booking--*` (9) |
| [client/payment.md](client/payment.md) | Payment & invoice | CUST-015 | MOD-06 | 2 | ready | 1.1.1 | 2026-11-10 | `customer--payment--*` (2) |
| [client/wallet.md](client/wallet.md) | Wallet | CUST-016 | MOD-06 | 2 | ready | 1.0.1 | 2026-11-04 | `customer--wallet--*` (1) |
| [client/orders.md](client/orders.md) | My orders & status tracking (tabs, timeline, preview transport and tracking grant) | CUST-017, CUST-019 | MOD-05 | 2 | ready (live-tracking limits TD-147 open) | 3.8.0 | 2026-11-09 | `customer--booking--0[5-6]-*`, `customer--orders--0[1-4]-*` (decision states, tabs), `customer--order-tracking--01-*` |
| [client/chat.md](client/chat.md) | Paid order text chat with provider | CUST-018 | MOD-10 | Prod | ready (DEC-14 retention, DEC-27 calls open) | 3.0.1 | 2026-11-02 | `customer--chat--*` (1) |
| [client/notifications.md](client/notifications.md) | Notifications & FCM push delivery | CUST-022 | MOD-10 | 2 | ready | 1.4.0 | 2026-11-08 | `customer--notifications--*` (1); built: device token registration, inbox (rows of a template with in-app off are hidden; switching a template off keeps the history, TD-168), FCM push, per-category switches (TD-166), template engine, automated reminders and all BRD triggers (TD-167). |
| [client/cancellation.md](client/cancellation.md) | Cancellation | CUST-020 | MOD-08 | 3 | ready | 1.2.1 | 2026-11-02 | `customer--orders--0[5-6]-*` (2) |
| [client/my-packages.md](client/my-packages.md) | Buying packages & redeeming sessions (D1) | D1 · CUST-008 | MOD-02, MOD-06 | 2 | ready | 1.1.0 | 2026-11-03 | `customer--packages--02-details-p2*` (1) |
| [client/ratings.md](client/ratings.md) | Rating the provider (tags, comment, one per order) | CUST-021 | MOD-11 | 4 | ready | 1.0.0 | 2026-11-02 | `customer--reviews--*` (1) |
| [client/support.md](client/support.md) | Support & contact (reasons, tickets, thread, follow-up) | CUST-024 | MOD-10 | 4 | ready | 1.3.0 | 2026-11-09 | `customer--account--02-*` (1) |
| [client/content.md](client/content.md) | Static pages (terms, privacy, cancellation, about, female declaration) and FAQs, public | CUST-002 · CUST-024 | MOD-10 | 1 | ready | 1.0.0 | 2026-11-08 | — |

### 4.2 Provider — Service provider app (Flutter)

| Doc | Feature | BRD IDs | Module | Phase | Status | Version | Updated | Screens |
|-----|---------|---------|--------|-------|--------|---------|---------|---------|
| [provider/auth.md](provider/auth.md) | Registration & login | PROV-001, PROV-005 | MOD-01 | 1 | ready | 2.2.0 | 2026-11-08 | `provider--auth--*`, `provider--registration--0[1-2]-*` (3) |
| [provider/onboarding.md](provider/onboarding.md) | Required info, service selection, approval status | PROV-002, PROV-003, PROV-004 | MOD-01 | 1 | ready | 1.0.4 | 2026-11-08 | `provider--registration--0[3-5]-*` (5) |
| [provider/profile-change-requests.md](provider/profile-change-requests.md) | Reviewed changes after approval: work area, bank, identity, documents (BR-04, TD-184); built and tested, not deployed | PROV-008 | MOD-01 | 1 | ready (not deployed) | 1.0.1 | 2026-11-11 | — (not captured) |
| [admin/profile-change-requests.md](admin/profile-change-requests.md) | Review of provider and driver change requests: list, approve, reject (BR-04, TD-184) | ADMIN-004, ADMIN-006 | MOD-12 | 1 | ready (not deployed) | 1.0.0 | 2026-11-10 | — (no admin prototype) |
| [provider/profile.md](provider/profile.md) | Direct photo/bio/title/transport and portfolio; first-set city/coverage/payout (TD-76/77); mobile change by OTP (TD-91); reviewed changes pending (§13, DEC-25) | PROV-008 | MOD-01 | 1 | ready (scoped TD-72/73/75/76/77) | 1.2.2 | 2026-11-02 | `provider--account--0[1-6]-*`, `provider--availability--02-*` (8; edit-profile-p1/p2 and 06-bank-account opened) |
| [provider/services-pricing.md](provider/services-pricing.md) | Service management & pricing | PROV-009, PROV-010 | MOD-02 | 1 | ready | 1.1.0 | 2026-10-25 | `provider--services-pricing--*` (5) |
| [provider/packages.md](provider/packages.md) | Package management | PROV-011 | MOD-02 | 1 | ready | 1.0.1 | 2026-11-04 | `provider--packages--*` (6) |
| [provider/home.md](provider/home.md) | Home page | PROV-006 | MOD-03 | 2 | ready | 1.1.0 | 2026-11-05 | `provider--home--*` (3) |
| [provider/availability.md](provider/availability.md) | Instant availability & appointments | PROV-012, PROV-013 | MOD-04 | 2 | ready | 1.0.0 | 2026-10-25 | `provider--availability--01-*`, `provider--home--01-*` (3) |
| [provider/orders.md](provider/orders.md) | Receiving, accepting/rejecting, schedule tabs, completed/cancelled tabs, `can_*` flags and chat gate | PROV-014, PROV-015, PROV-022 | MOD-05 | 2 | ready | 2.7.0 | 2026-11-09 | `provider--requests--01-*`, `provider--schedule--0[1-3]-*` |
| [provider/chat.md](provider/chat.md) | Paid order text chat with customer | PROV-021 | MOD-10 | Prod | ready (DEC-14 retention, DEC-27 calls open) | 3.0.1 | 2026-11-02 | `provider--chat--*` (1) |
| [provider/notifications.md](provider/notifications.md) | Notifications & FCM push delivery | PROV-025 | MOD-10 | 2 | ready | 1.4.0 | 2026-11-08 | `provider--notifications--*` (1); built: device token registration, inbox with inactive-template suppression, FCM push, per-category switches (TD-166), template engine, automated reminders and all BRD triggers (TD-167). |
| [provider/transportation.md](provider/transportation.md) | Travel method & requesting a driver | PROV-017, PROV-018 | MOD-07 | 3 | ready | 1.0.1 | 2026-11-08 | `provider--session--0[2-4]-*` (4) |
| [provider/order-execution.md](provider/order-execution.md) | Status updates, service completion & driver arrival confirmation | PROV-019, PROV-020 | MOD-05 | 3 | ready | 1.4.0 | 2026-11-09 | `provider--session--01-*`, `provider--session--0[5-6]-*` (3) |
| [provider/cancellation.md](provider/cancellation.md) | Order cancellation | PROV-016 | MOD-08 | 3 | ready | 1.0.1 | 2026-11-02 | `provider--appointments--*` (1) |
| [provider/earnings.md](provider/earnings.md) | Amounts due & manual payout requests (DEC-11, TD-158) | PROV-023 | MOD-06 | 3 | ready | 1.0.0 | 2026-11-02 | `provider--earnings--*`, `provider--account--06-*` (2) |
| [provider/featured-subscription.md](provider/featured-subscription.md) | Featured subscription | PROV-007 | MOD-09 | 4 | ready | 1.2.1 | 2026-11-08 | `provider--featured--*` (4) |
| [provider/ratings.md](provider/ratings.md) | Feedback history from customers + rating the customer | PROV-024 | MOD-11 | 4 | ready | 1.0.0 | 2026-11-02 | `provider--reviews--*` (2) |
| [provider/support.md](provider/support.md) | Support & contact (reasons, tickets, thread, follow-up) | PROV-026 | MOD-10 | 4 | ready | 1.3.0 | 2026-11-09 | `provider--support--*` (1) |
| [provider/content.md](provider/content.md) | Static pages (terms, privacy, cancellation, about, female declaration) and FAQs, public | PROV-001 · PROV-026 | MOD-10 | 1 | ready | 1.0.0 | 2026-11-08 | — |

### 4.3 Delivery — Driver app (Flutter)

| Doc | Feature | BRD IDs | Module | Phase | Status | Version | Updated | Screens |
|-----|---------|---------|--------|-------|--------|---------|---------|---------|
| [delivery/auth.md](delivery/auth.md) | Registration & login | DRIV-001, DRIV-004 | MOD-01 | 1 | ready | 2.2.0 | 2026-11-08 | `driver--auth--*`, `driver--registration--01-*` (2) |
| [delivery/onboarding.md](delivery/onboarding.md) | Required info & approval status | DRIV-002, DRIV-003 | MOD-01 | 1 | ready | 1.0.1 | 2026-10-26 | `driver--registration--0[2-3]-*` (3) |
| [delivery/profile-change-requests.md](delivery/profile-change-requests.md) | Reviewed changes after approval: work area, bank, identity, vehicle, documents (BR-04, TD-184); built and tested, not deployed | DRIV-006 | MOD-01 | 1 | ready (not deployed) | 1.0.1 | 2026-11-11 | — (not captured) |
| [delivery/profile.md](delivery/profile.md) | Account completion: work area, photo, personal, payout; reviewed changes pending (DEC-25) | DRIV-006 | MOD-01 | 1 | ready (scoped TD-76/77) | 1.0.2 | 2026-11-02 | — (not captured) |
| [delivery/home.md](delivery/home.md) | Home page | DRIV-005 | MOD-03 | 3 | ready | 1.1.0 | 2026-11-08 | `driver--home--*` (2) |
| [delivery/availability.md](delivery/availability.md) | Enabling availability | DRIV-007 | MOD-07 | 3 | ready | 1.0.1 | 2026-11-08 | `driver--home--*` (2) |
| [delivery/trip-requests.md](delivery/trip-requests.md) | Receiving, accepting/rejecting, trip details | DRIV-008, DRIV-009, DRIV-010 | MOD-07 | 3 | ready | 1.0.2 | 2026-11-09 | `driver--trips--*` (1) |
| [delivery/trip-execution.md](delivery/trip-execution.md) | Start → at provider → pickup → at customer → arrival; live location; arrival confirmation by any party + driver earning (DRIV-015, TD-149) | DRIV-011, DRIV-012, DRIV-013, DRIV-014, DRIV-015 | MOD-07 | 3 | ready (DEC-07 partly open) | 1.4.0 | 2026-11-09 | — (not captured) |
| [delivery/trips.md](delivery/trips.md) | Current & past trips | DRIV-016 | MOD-07 | 3 | ready | 1.1.1 | 2026-11-02 | — (not captured) |
| [delivery/ratings.md](delivery/ratings.md) | Driver review history: ratings providers gave her (R04, TD-183) | DRIV-005 | MOD-11 | 4 | ready | 1.0.0 | 2026-11-09 | — (not captured) |
| [delivery/earnings.md](delivery/earnings.md) | Amounts due & manual payout requests (DEC-11, TD-158) | DRIV-017 | MOD-06 | 3 | ready | 1.0.0 | 2026-11-02 | — (not captured) |
| [delivery/notifications.md](delivery/notifications.md) | Notifications & FCM push delivery | DRIV-018 | MOD-10 | 3 | ready | 1.5.0 | 2026-11-08 | `driver--notifications--*` (1); built: device token registration, inbox with inactive-template suppression, FCM push, per-category switches (TD-166), template engine, automated reminders and all BRD triggers (TD-167). |
| [delivery/support.md](delivery/support.md) | Support & contact (reasons, tickets with trip link, thread, follow-up) | DRIV-019 | MOD-10 | 4 | ready | 1.2.0 | 2026-11-09 | — (not captured) |
| [delivery/content.md](delivery/content.md) | Static pages (terms, privacy, cancellation, about, female declaration) and FAQs, public | DRIV-001 · DRIV-019 | MOD-10 | 1 | ready | 1.0.0 | 2026-11-08 | — |

### 4.4 Admin — Dashboard (React JS)

| Doc | Feature | BRD IDs | Module | Phase | Status | Version | Updated | Screens |
|-----|---------|---------|--------|-------|--------|---------|---------|---------|
| [admin/auth.md](admin/auth.md) | Login | ADMIN-001 | MOD-01 | 1 | ready | 4.0.1 | 2026-11-08 | — (no admin prototype) |
| [admin/admins-permissions.md](admin/admins-permissions.md) | Administrators & permissions | ADMIN-024 | MOD-01 | 1 | ready | 3.0.3 | 2026-11-08 | — (no admin prototype) |
| [admin/customers.md](admin/customers.md) | Customer management | ADMIN-003 | MOD-01 | 1 | ready | 2.2.0 | 2026-11-08 | — (no admin prototype) |
| [admin/providers.md](admin/providers.md) | Service provider management | ADMIN-004 | MOD-01 | 1 | ready | 2.3.0 | 2026-11-08 | — (no admin prototype) |
| [admin/drivers.md](admin/drivers.md) | Driver management | ADMIN-006 | MOD-01 | 1 | ready | 2.2.0 | 2026-11-08 | — (no admin prototype) |
| [admin/registration-review.md](admin/registration-review.md) | Registration request review (+ providers' extra-category requests, AC-PROV-009) | ADMIN-007 | MOD-01 | 1 | ready | 1.0.0 | 2026-10-25 | — (no admin prototype) |
| [admin/service-areas.md](admin/service-areas.md) | Service area management (countries, cities, districts, delivery fee rules) | ADMIN-021 | MOD-03 | 1 | ready | 1.1.0 | 2026-11-09 | — (no admin prototype) |
| [admin/services.md](admin/services.md) | Services, options, price ranges & Joshen occasion tags | ADMIN-008, ADMIN-009, ADMIN-010, ADMIN-012 | MOD-02 | 1 | ready | 2.1.1 | 2026-11-08 | — (no admin prototype) |
| [admin/packages.md](admin/packages.md) | Package management (review, hide/show) | ADMIN-011 | MOD-02 | 1 | ready | 1.0.0 | 2026-10-25 | — (no admin prototype) |
| [admin/joshan.md](admin/joshan.md) | Joshen finder management | ADMIN-012 | MOD-03 | 2 | ready | 1.0.0 | 2026-10-26 | — (no admin prototype) |
| [admin/orders.md](admin/orders.md) | Order management (read-only monitor, delay flag; trip summary, invoice summary) | ADMIN-013 | MOD-05 | 2 | ready (scoped; chat monitor TD-150) | 2.5.0 | 2026-11-10 | — (no admin prototype) |
| [admin/payments.md](admin/payments.md) | Payment management | ADMIN-015 | MOD-06 | 2 | ready | 1.2.0 | 2026-11-10 | — (no admin prototype) |
| [admin/notifications.md](admin/notifications.md) | Notification management | ADMIN-020, ADMIN-026 (alerts) | MOD-10 | 2 | ready | 1.4.0 | 2026-11-08 | — (no admin prototype) |
| [admin/transportation-monitoring.md](admin/transportation-monitoring.md) | Transportation monitoring | ADMIN-014 | MOD-07 | 3 | ready | 1.1.0 | 2026-11-01 | — (no admin prototype) |
| [admin/commissions.md](admin/commissions.md) | Platform commission management (rules, schedule, in-force state) | ADMIN-016 | MOD-06 | 3 | ready | 1.0.1 | 2026-11-10 | — (no admin prototype) |
| [admin/payouts.md](admin/payouts.md) | Transfer-request desk, audited IBAN read, manual decisions, balances (DEC-11, TD-158) | ADMIN-017 | MOD-06 | 3 | ready | 1.0.0 | 2026-11-02 | — (no admin prototype) |
| [admin/cancellations-refunds.md](admin/cancellations-refunds.md) | Cancellation & refund management | ADMIN-018 | MOD-08 | 3 | ready | 2.1.0 | 2026-11-10 | — (no admin prototype) |
| [admin/featured-subscriptions.md](admin/featured-subscriptions.md) | Featured subscription management | ADMIN-005 | MOD-09 | 4 | ready | 1.0.3 | 2026-11-10 | — (no admin prototype) |
| [admin/ratings.md](admin/ratings.md) | Rating management (publish / hide, averages) | ADMIN-019 | MOD-11 | 4 | ready | 1.1.0 | 2026-11-10 | — (no admin prototype) |
| [admin/banners.md](admin/banners.md) | Banner management | ADMIN-023 | MOD-03 | 4 | ready | 1.0.1 | 2026-11-11 | — (no admin prototype) |
| [admin/support.md](admin/support.md) | Support desk (requests of all three apps; deprecated contact messages kept) | ADMIN-026 | MOD-10 | 4 | ready | 1.2.0 | 2026-11-09 | — (no admin prototype) |
| [admin/dashboard.md](admin/dashboard.md) | Main dashboard | ADMIN-002 | MOD-03 | 4 | ready | 1.0.0 | 2026-11-02 | — (no admin prototype) |
| [admin/reports.md](admin/reports.md) | Reports & statistics | ADMIN-022 | MOD-12 | 4 | ready | 1.0.0 | 2026-11-02 | — (no admin prototype) |
| [admin/settings.md](admin/settings.md) | Platform settings | ADMIN-025 | MOD-12 | 4 | base (TD-32) | 0.18.1 | 2026-11-10 | — (no admin prototype) |
| [admin/coupons.md](admin/coupons.md) | Coupons (design addition) | Design · ADMIN-015/016 · CUST-011/014 | MOD-06 | 2 | ready (TD-131; TD-148 awaiting owner confirmation) | 1.0.1 | 2026-11-10 | — (no admin prototype) |
| [admin/content.md](admin/content.md) | FAQs, static pages (terms, privacy, cancellation policy, female declaration), onboarding slides | Design · CUST-002 | MOD-12 | 1 | base (TD-32) | 0.3.2 | 2026-11-11 | — (no admin prototype) |

> `admin/settings.md` is Phase 4 for the full screen, but individual settings
> (driver search duration, deadlines, fees…) are added in the phase of the
> feature that reads them. Each addition bumps `admin/settings.md`.

**Coverage:** 95 / 95 BRD features mapped (client 24 · provider 26 · delivery 19 · admin 26).

### 4.5 Client decisions and design additions → docs

Scope added by D1–D4 and the schema header has no BRD ID; it lives in these docs.

| Addition | Source | Doc(s) |
|----------|--------|--------|
| Prepaid multi-session packages, Joshen review | D1 | `provider/packages.md`, `admin/packages.md`, `client/catalog.md`, `client/my-packages.md` |
| Group booking (several people, one delivery fee) | D2 | `client/booking.md`, `provider/orders.md`, `admin/orders.md` |
| Instant-booking accept window + auto refund | D3 | `client/booking.md`, `provider/orders.md`, `provider/availability.md` |
| Establishment = one account | D4 | `provider/onboarding.md` |
| Coupons | Design | `admin/coupons.md`, `client/payment.md` |
| Saved cards, Apple Pay, Tabby | Design | `client/payment.md` |
| Several Featured plans + VAT, pay from earnings | Design | `provider/featured-subscription.md`, `admin/featured-subscriptions.md` |
| Cancellation fee rules | Design | `admin/cancellations-refunds.md`, `client/cancellation.md`, `provider/cancellation.md` |
| Rating tags, private notes, provider→driver rating | Design | `client/ratings.md`, `provider/ratings.md`, `admin/ratings.md` |
| Notification preferences | Design | `*/notifications.md` |
| Provider radius + districts, default transport preference | Design | `provider/profile.md`, `provider/transportation.md` |
| Document expiry dates | Design | `*/onboarding.md`, `admin/registration-review.md` |
| Service duration, notes to the specialist, customer city / birth year / photo | Design | `admin/services.md`, `client/booking.md`, `client/profile.md` |
| Onboarding slides | Design | `admin/content.md`, `*/home.md` |

## 5. Existing base code (pre-BRD)

The project started from a generic Laravel base. Per **TD-08 (Mixed)**,
identity, admin RBAC, and geography are **reused and extended**; base tables that
overlap the schema's business domain are **replaced** by the schema version
inside the feature that owns them (full list: [database/README.md §2](database/README.md#2-schema--base-mapping-td-08)).
Admin base routes are documented at 0.x in their owner docs (TD-32); client-side base
routes (`/client/settings`, the deprecated `/client/contact`, and the `/client/{countries,governorates,regions}` lists) still have no client guide of their own (re-checked 2026-11-08; profile, addresses and the rest are documented); base `/client/sliders` and `/client/search/*` were retired by TD-80.

| Existing code | Endpoints today | Owner feature (doc) | Gap vs BRD to close |
|---------------|-----------------|---------------------|---------------------|
| AppAuthService + per-surface AuthControllers | Each app: /auth/{register,login,verify,resend-code,refresh,logout,me} | [client/auth.md](client/auth.md), [provider/auth.md](provider/auth.md), [delivery/auth.md](delivery/auth.md) | Closed: phone OTP, profile/consent/wallet transaction, app JWT and approval middleware, app device associations. Password paths removed; SMS gateway remains open (DEC-15). |
| Admin AuthController / AdminAuthService | /admin/auth/{login,refresh,logout,me,my-permissions}, profile | [admin/auth.md](admin/auth.md) | Closed: admin-only credentials, app claim, refresh/me, role and grouped permissions dictionary (`{resource: [actions]}`); `auth/my-permissions` (flat + per section; super admin = flag with empty lists, TD-53); self-profile RBAC exemption. |
| Client `ProfileController` | `/client/profile` (GET, PUT) and `/client/profile/phone{,/resend-code,/verify}` | [client/profile.md](client/profile.md) (1.0.0) | Closed: direct edit (name, email, city, birth year, photo) and mobile change verified by OTP on the new number (TD-89); `DELETE` stays unrouted; no password (DEC-15). |
| Client `AddressController` | Legacy controller, services and request deleted (TD-84); six routes use CustomerAddressController on `customer_addresses` | [client/addresses.md](client/addresses.md) (1.0.0) | CUST-004 ready: UUID ownership, active city/district Domain guards, atomic defaults and soft-delete/newest promotion (TD-68/69). |
| Client `WalletController` | `/client/wallet` | [client/wallet.md](client/wallet.md) (1.0.1, TD-164) | Customer refund wallet and full-order payment; no top-up or withdrawal. Legacy `/transactions` and `/withdraw` stay unrouted. |
| Notifications (shared/client/admin) | Shared `/notifications` inbox (list, show/read, delete, mark-all-read, clear-all); `POST /{client,provider,delivery}/notifications/device`; `/notifications/preferences/categories` (GET, PUT); admin `/admin/notifications` (monitor, templates, deliveries, `general` sends), `POST /admin/auth/device` (browser web push) | `*/notifications.md` | Built: device registration, inbox with inactive-template suppression, FCM push, category preferences, full template engine (60 active events across 3 apps), delivery audit log, log SMS gateway, automated reminders, admin notification monitoring (ADMIN-020, ADMIN-025, CUST-022, PROV-025, DRIV-018, TD-167); admin dashboard alerts for 7 events through the shared inbox + Firebase web push, and admin general notifications to all / cities / picked users of the apps (TD-173). |
| Content: FAQs, static pages, sliders | `/admin/{faqs,pages,sliders}`; customer banners now come from `/client/home` (`/client/sliders` retired, TD-80). Public `GET /{client,provider,delivery}/pages/{slug}` and `/faqs` return with [client/content](client/content.md), [provider/content](provider/content.md), [delivery/content](delivery/content.md) (TD-175, supersedes the pages/FAQ part of TD-30) | [client/home.md](client/home.md) (1.0.0), [admin/banners.md](admin/banners.md) (1.0.0), [admin/content.md](admin/content.md) (0.2.0, TD-32) | Banners now carry **target app, placement, link and display dates** with `{ar, en}` text (ADMIN-023, [admin/banners.md](admin/banners.md) 1.0.0, TD-99); the provider and driver apps get their banners in `banners` on `GET /provider/home` and `GET /delivery/home` ([provider/home](provider/home.md), [delivery/home](delivery/home.md), 1.1.0). Static pages hold the policies accepted at registration — the consent screens link to them through the public pages endpoints (TD-175); the content itself still has to be written before launch. Static pages now editable on the schema (0.2.0); FAQ audience not settable. |
| Geo: countries, governorates, regions, delivery fee rules | `/client/{countries,governorates,regions}`, `/admin/{countries,governorates,regions,delivery-fee-rules}` | [admin/service-areas.md](admin/service-areas.md) (1.0.0, TD-82/83) | Closed: CRUD, guarded delete (409 `SERVICE_AREA_IN_USE`), fee rules and `DeliveryFeeCalculator` (BR-11). Defaults are now `SA`/`SAR` (DEC-17); the country seed still lists Egypt first — load Saudi cities/districts before launch. Coverage is set by the account owner and, in any status, by the admin (`PUT /admin/{providers,drivers}/{id}/work-area`, TD-83). |
| `CategoryController` + `ServiceController` | `/admin/categories`, `/admin/services` (+ tree/toggles) | [admin/services.md](admin/services.md) (2.1.0, TD-33/34/37/38/40/41/42/115) | Closed: flat categories, type1 bookable services → type2 option groups → type3 choices, exact/free-choice ranges, guarded deletion, ancestor/addon visibility views, scoped permissions, transactional audits, HasMedia image hashes on both models, optional unique category slug, and type-1 occasion UUID tagging. Existing provider_services reused for actual prices; provider-app pricing/booking endpoints remain separate features. |
| `UserController` | `/admin/users` (+ toggle-active, wallet-transactions) — customers only (BR-29) | [admin/customers.md](admin/customers.md) (2.1.0, ADMIN-003 scoped delivery) | Standard users pagination/filters/sorts; customer_addresses, consents, wallet balance/refund-credit history/counts; audited account-wide block/unblock. Orders, payments, invoices, refunds, ratings and chat are managed in their own sections ([admin/orders.md](admin/orders.md), [admin/payments.md](admin/payments.md), [admin/cancellations-refunds.md](admin/cancellations-refunds.md), [admin/ratings.md](admin/ratings.md)). (§13); providers/drivers use separate endpoints. |
| `ProviderController` + shared `AccountReviewService` | `/admin/providers` list/details/identity and approve/reject/request-changes/suspend/reactivate | [admin/providers.md](admin/providers.md) (2.1.0, ADMIN-004 scoped delivery) | Provider-owned content read-only; audited identity read under approve grant; IBAN always masked; transactional document verification/profile/event/audit/inbox; audited full document numbers (TD-50/51); identity numbers never searchable (TD-54); `featured_status` active/expired/not_subscribed beside ranking `is_featured` (TD-55); ISO 8601 dates. Initial approve promotes requested registration categories atomically with reviewer/time (TD-60); provider onboarding 1.0.0 now supplies real submissions. Important-change request review partially covered (TD-44); commerce/subscription history/confirmed-order effects deferred (§13). ADMIN-006 now reuses shared review; ADMIN-007 is ready ([admin/registration-review.md](admin/registration-review.md)) as one queue over it. |
| `DriverController` + shared `AccountReviewService` | `/admin/drivers` list/details/identity and five status actions | [admin/drivers.md](admin/drivers.md) (2.0.0, ADMIN-006 scoped delivery) | Shared document-verification/review/event/audit/inbox workflow; identity/IBAN masked by default, public plates, audited full identity/document numbers, ID never searchable (TD-54), ISO 8601 dates; active vehicle required on initial approval (TD-50/51/52); real coverage/online-only location. Important-change decisions, trip/financial workflows and confirmed-trip effects deferred (§13). ADMIN-007 is ready as a combined queue. |
| Roles, permissions, supervisors | `/admin/{roles,permissions,supervisors}` (+ toggle-active), `/admin/audit-logs` | [admin/admins-permissions.md](admin/admins-permissions.md) | Closed: 21 × 5 matrix from `config/rbac.php` + `rbac:sync-permissions` (TD-27); RBAC enforced in every environment, uuid-only bodies, security rules (TD-28). `/admin/users` lists customers only (BR-29). |
| Settings | `/admin/settings`, `/client/settings` | [admin/settings.md](admin/settings.md) (0.15.2, TD-32/73/84/114/133/158/164/165/167/168/170/172) | Generic settings supports search (key, value, group, metadata) and group filter, validates booking and Joshen app_configs writes with `JoshenSettings`; feature flags index supports search over key, description, and status. Unknown legacy key behavior and remaining ADMIN-025 editor scope stay as documented. |
| Support desk | `/client/support/*`, `/provider/support/*`, `/delivery/support/*`, `/admin/support-tickets` | `*/support.md` ([admin/support.md](admin/support.md) 1.1.0, TD-162, TD-163, TD-179) | Tickets with reasons per app, thread, attachments, statuses under_review → replied → closed (DEC-21); `replied` only by replying; the requester is notified. The base contact form (`/client/contact`) and `/admin/contact-messages` are deprecated but unchanged — both apps still use them (TD-163). |
| `DashboardController` | `/admin/dashboard` | [admin/dashboard.md](admin/dashboard.md) (1.0.0, TD-161) | Closed: dashboard and [admin/reports.md](admin/reports.md) share one figure definition (orders, money, subscriptions, rankings; DEC-20 partly resolved). Server versions block removed. |
| Search | `/client/search` (services/packages/providers); base `/client/search/{suggestions,recent,trending,popular}` retired (TD-80) | [client/catalog.md](client/catalog.md) (1.1.1) / [client/joshan.md](client/joshan.md) (1.0.0) | Catalog search reuses shared eligibility then featured ranking (BR-08/09, TD-78/79); Joshen guided search is implemented with one persisted search per pagination chain (CUST-009, TD-118). |
| Infra: feature flags, audit logs, health, bootstrap config | `/admin/{feature-flags,audit-logs}`, `/health`, `/config/bootstrap` | audit logs: [admin/admins-permissions.md](admin/admins-permissions.md); feature flags: [admin/settings.md](admin/settings.md) | Audit trail fixed (entries written in the save transaction); feature flags documented (the dashboard consumes them); health/bootstrap: platform tooling, document only if apps consume them. |

## 6. Delivery phases

From Project Guide §15 (a planning sequence, not a scope cut — all 95 features stay in scope).

| Phase | Goal | Gate |
|-------|------|------|
| 0 | Clarify contracts: decisions, permission matrix, state definitions, operating values | Owners assigned; money/state DECs resolved for Phase 1–2 |
| 1 | Enable participants: accounts, OTP, profiles, provider/driver review, admin roles, service areas, catalog, pricing, packages | A provider and a driver reach approved operational state |
| 2 | Complete a booking: discovery, Joshan, availability, instant + scheduled booking, payment, wallet, notifications, chat | Both booking types with correct eligibility, pricing, confirmation |
| 3 | Fulfill and settle: travel, driver journey, cancellation/refund, completion, commissions, earnings, payouts | Full business cycles with correct financial records |
| 4 | Complete scope: featured subscriptions, ratings, support, banners, reports, all settings | All 95 IDs implemented and documented |
| 5 | Accept and release | Recorded stakeholder acceptance |

## 7. Blocking decisions by phase

Still open after the schema (details in [DECISIONS.md](DECISIONS.md)). Resolve
or record a working assumption before the phase starts.

| Phase | Decisions to settle |
|-------|---------------------|
| 1 | SMS provider for OTP (DEC-15) — the SMS channel only logs today |
| 2 | DEC-04 (capacity / overlapping bookings), DEC-05 (deadline values), DEC-06 (payment gateway vendor — the simulator is a launch blocker, TD-94), DEC-09 (VAT base on orders, rounding) |
| 3 | DEC-07 (driver cancel / no-show after accepting); TD-147 open items (ETA / distance source, stale-location threshold, live-map content, self-travel position — R06–R08, TD-182). Resolved: DEC-08 (TD-149), DEC-10 (wallet only, TD-152), DEC-11 (TD-158) |
| 4 | DEC-12 (subscription refunds / suspension), DEC-20 (KPIs, partly resolved TD-161), DEC-14 chat retention, DEC-25 (document and bank changes), DEC-27 calls, DEC-28 (unmutable notifications), DEC-29 (push token on logout) |