Problems & Observations

InlineAnalyticsChat in app/chat/page.tsx returns early when res.body has no reader — before the setLoading(false) at the bottom of the function. A bodyless or interrupted stream response permanently disables the send button for that tab until a refresh. The reset belongs in a finally block.

Fix effort: Same finally-block fix.

app/chat/page.tsx InlineAnalyticsChat sendMessage (~156–157): const reader = res.body?.getReader(); if (!reader) return; — early return skips setLoading(false) at line 192 (only reached after while loop). Bodyless or opaqueredirect responses wedge Send disabled until refresh. Belongs in finally { setLoading(false) }.

Fix effort: Wrap sendMessage body in try/finally { setLoading(false) } in app/chat/page.tsx.

lib/anomaly/service.ts acknowledgeAnomaly() and dismissAnomaly() update anomaly_detections by UUID only via the service-role client — no .eq('company_id', …). Any authenticated user or v1 API-key holder who knows another tenant's anomaly ID can change its status. Callers: app/api/anomalies/route.ts POST and app/api/v1/anomalies/route.ts PATCH.

Fix risk: Tenant guard may reject legitimate cross-service calls that used bare UUID today.

Fix effort: Add .eq('company_id', callerCompany) to two service-role updates in lib/anomaly/service.ts; pass company from route handlers.

acknowledgeAnomaly() and dismissAnomaly() in lib/anomaly/service.ts update anomaly_detections by id alone, through the service-role client — no company_id filter. Any authenticated user (or v1 API-key holder, via /api/anomalies POST and /api/v1/anomalies PATCH) who knows or guesses another tenant's anomaly UUID can acknowledge or dismiss it. Classic IDOR: the fix is one .eq('company_id', callerCompany) on both updates.

Fix effort: Same IDOR fix as above — duplicate audit entry.

app/login/page.tsx reads params.get('redirect') unchanged and passes it to router.push after sign-in (line 56). A crafted ?redirect=https://evil.com or //evil.com sends users to an external site immediately after they authenticate. Should validate same-origin relative paths only.

Fix effort: Validate redirect starts with / and has no // protocol-relative trick in app/login/page.tsx (~10 lines).

app/api/internal/shanetree-relay-fulfill/route.ts updates shanetree_relay_requests with .eq('id', body.request_id).eq('status', 'claimed') only — no company_id check. Parallel to willcall-print-done: shared secret + UUID lets any tenant's claimed relay be closed out.

Fix effort: Add company_id to fulfill body + .eq('company_id', …) like willcall-print-claim.

app/api/v1/batch/route.ts (~133) sets baseUrl from NEXT_PUBLIC_SITE_URL || NEXT_PUBLIC_APP_URL || 'http://localhost:3000'. On Vercel/serverless without those env vars, batch sub-requests hit localhost and fail silently for API consumers — distinct from tracked batch path allowlist gap.

Fix risk: Changing base URL breaks batch in Vercel preview unless VERCEL_URL always set — integrators depend on current fallback in dev.

Fix effort: Fail closed when SITE_URL unset, or derive from request.headers.get('host') in batch/route.ts.

app/api/internal/willcall-print-done/route.ts authenticates INTERNAL_API_SECRET then updates will_call_print_requests with .eq('id', body.id) only — no company_id filter. Contrast willcall-print-claim which does filter by company. Anyone with the shared secret can mark any tenant's print job done/failed if they know the UUID.

Fix effort: Add company_id to DoneBody + .eq('company_id', …) like willcall-print-claim; bridge caller must send company.

loadSlots() in app/window/WindowClient.tsx (~194–205) catch sets setSlots({}) on fetch/parse failure. Empty slots means no booked/requested flags — all times look open during API outages, inviting bookings into already-accepted slots. No error banner distinguishes outage from genuinely open grid.

Fix effort: Show error state in WindowClient when loadSlots fails instead of setSlots({}).

POST /api/greco/analytics-chat authenticates any user with profile.company_id and canAccessAgent (~248–258) but never calls checkCompanyAIAccess() and never compares companyId to NEXT_PUBLIC_GRECO_COMPANY_ID. Non-Greco tenants with agent access can invoke GRECO_TOOL_DEFINITIONS (queryDailyStats, executeReadOnlySql against greco_daily_stats, firmas_entries, report tables). app/chat/page.tsx also posts here — widens the bypass beyond /daily-stats.

Fix effort: Add checkCompanyAIAccess + GRECO_COMPANY_ID guard before streaming; same pattern as v1 AI routes.

confirmAccept/handleReject in app/quotes-admin/page.tsx (~269–310) use browser createSupabaseClient().update({ status }). Migration 012 UPDATE policy requires user_id = auth.uid() AND status = 'pending' in both USING and WITH CHECK — accepting sets status='accepted', which violates WITH CHECK. Admin cannot accept another user's submission via this page. Dashboard correctly uses /api/admin/submissions (service role) at dashboard/page.tsx ~1387.

Fix effort: Route accept/reject through /api/admin/submissions like dashboard does, or add admin UPDATE policy.

CONSUMED_STATUSES = ['pending','printing','done'] in app/api/public/will-call-print-request/route.ts (~50, 146–147). GET printed list and POST alreadyPrinted guard count pending as consumed. SalesClient.tsx (~825–835, ~927–930) hides the print button immediately and reload keeps it hidden even when the bridge PC is offline — client re-enables only on poll failed/timeout (~965–982), not on stuck pending forever in DB.

Fix effort: Exclude pending from CONSUMED_STATUSES; only count printing/done as consumed.

app/api/cron/agent-autonomy/route.ts (vercel.json */10) enqueues autonomous digest agent_task jobs for companies with auto_summarize / auto_email_digest enabled but never calls checkCompanyAIAccess(). Companies with AI disabled or exhausted quota still get background Gemini work — parallel to the port-ai-summary cron gap.

Fix risk: Adding checkCompanyAIAccess may stop digests companies think they enabled — pairs with decorative AgentSettings toggles.

Fix effort: Add checkCompanyAIAccess before enqueue in agent-autonomy/route.ts.

app/api/jobs/workers/ai-analysis/route.ts — on tool_ai_analyses insert error (~167–173) logs warn but still calls markJobCompleted() (~211–216). Pollers see status completed with no persisted analysis — distinct from tracked QStash stub (that path never calls Gemini either, but this worker did run AI).

Fix effort: Call markJobFailed() when tool_ai_analyses insert errors — don't markJobCompleted.

supabase/migrations/133_create_will_call_appointments.sql lines 62–67: UPDATE policy allows any profiles.company_id member with no role check. decideWillCallAppointment() in lib/supabase/window-appointments.ts (~107–117) updates by id only. /windowadmin is gated by GrecoOnlyGuard only (app/windowadmin/page.tsx) — not founder/admin like /controls — so viewers with a bookmark can accept/reject will-call requests via the browser client.

Fix effort: Tighten will_call_appointments UPDATE RLS to manager+; gate /windowadmin like /controls.

app/api/custom-tools/versions/route.ts (~66–90) checks only company_id, not created_by or is_public. Unlike custom-tools/data verifyToolAccess, any company member who knows a private tool UUID gets full version history including code snapshots.

Fix effort: Reuse verifyToolAccess from data route; filter versions by created_by or is_public.

openEmailSettingsModal() is defined in app/dashboard/page.tsx (~575) but grep finds zero callers — only setEmailSettingsModal(null) closes the modal (~2856, ~3142). The full per-tool recipient picker + AI-filter editor (~2837+) can never open. Tracked 'UI report emails ignore per-tool recipient lists' describes the symptom; this is the root cause — founders configure email in Controls member permissions but have no working dashboard surface to manage lists.

Fix effort: Wire openEmailSettingsModal to Reports/Tools gear buttons or delete modal and consolidate in Controls.

app/documents/page.tsx subscribeToDocument callback applies remote content/title whenever it differs from lastContentRef with no hasUnsavedChanges guard. A collaborator's postgres_changes save can overwrite another editor's in-progress unsaved typing. The broadcast content_diff path checks hasUnsavedChanges; the DB subscription path does not.

Fix risk: Ignoring remote events while dirty is correct but users collaborating may never see others' edits until save — behavior change.

Fix effort: Skip subscribeToDocument content apply when hasUnsavedChanges; show conflict banner instead.

generateDriverChatReply() in lib/driver-chat/ai.ts (~157–165) calls gatewayChatCompletion with no checkCompanyAIAccess(). Callers include POST /api/public/driver-chat (auto-reply on every driver message), GET /api/driver-chat/ai?test=1 and POST /api/driver-chat/ai-respond. Session AI kill-switch is tracked for agent/greco routes but driver-chat is a separate high-volume public path that can burn tokens even when AI is disabled or over quota.

Fix effort: Call checkCompanyAIAccess in generateDriverChatReply and public driver-chat POST before gateway.

lib/tools/processors/forklift.ts computes report_date as new Date().toISOString().split('T')[0] — UTC. Any upload after 7-8pm Eastern lands on tomorrow's date, disagreeing with the operator's expectation and with the other Greco tools that use local/bridge dates. That skews the leaderboard, date filters and the anomaly baselines keyed on report_date.

Fix risk: Switching to local/bridge date reorders historical leaderboards, anomaly baselines, and greco_daily_stats keys — needs backfill or dual-read period.

Fix effort: Same timezone fix.

lib/tools/processors/forklift.ts (~171–192): const reportDate = new Date().toISOString().split('T')[0] stamps report_date in UTC. Eastern uploads after ~7–8pm local land on tomorrow's date vs operator expectation and bridge-local dates in other Greco tools. Skews leaderboard sort, /dashboard date filters and anomaly baselines keyed on report_date.

Fix risk: Same UTC report_date semantics — downstream stats already keyed on UTC days.

Fix effort: Use existing bridge/local date helper (or America/New_York) in lib/tools/processors/forklift.ts — one line + verify leaderboard filters.

app/api/admin/godview/route.ts counts team_chat_messages for overview (~226, ~238), per-company stats (~312) and message listings (~387). Live /team-chat uses chat_rooms / chat_room_messages. Same stale table in app/api/admin/analytics/route.ts (~66). GodView 'Team Messages' can read 0 while team-chat is active — misleading ops dashboard.

Fix effort: Retarget godview + admin/analytics counts to chat_room_messages.

vercel.json runs /api/cron/port-ai-summary every hour. The cron loops companies and calls generatePortAISummaryForCompany with no checkCompanyAIAccess import or call — multi-step Gemini work runs even when AI is disabled or over quota.

Fix risk: Enforcing policy stops summaries for companies that rely on cron today while UI AI still works.

Fix effort: Add checkCompanyAIAccess in cron loop before generatePortAISummaryForCompany.

supabase/migrations/130_create_item_email_alerts.sql enables RLS then adds FOR INSERT WITH CHECK (true) for anon. company_id is NOT NULL but has no REFERENCES companies(id). Anyone holding the public anon key can insert subscription rows pinned to any tenant UUID. /api/public/item-alert-subscribe pins Greco correctly in app code, but the database itself doesn't enforce that boundary.

Fix risk: Tightening anon INSERT policy can break /api/public/item-alert-subscribe if CHECK is too strict for kiosk flow.

Fix effort: New migration: tighten anon INSERT policy to Greco company_id + add FK on company_id; verify /api/public/item-alert-subscribe still works.

team-chat, documents, account, developer, build (and /vibe) all handle a missing session with router.push('/login'); return; — without ever clearing their loading state. If the client-side redirect is slow or interrupted, the user sits on a permanent FancyLoader / “Authenticating…” screen. Each guard should flip its loading flag (or render nothing) when it bails.

Fix risk: Fixing one page's guard without middleware can leave others spinning; dashboard bootstrap is shared across tabs.

Fix effort: Same spinner fix across auth-guard pages.

dashboard (router.replace at line 1203), account, team-chat, documents, build, developer, history and /vibe all call router.push/replace('/login') and return without clearing loading/auth state. Users sit on FancyLoader / 'Authenticating…' indefinitely. quote/page.tsx does it right (finally { setLoading(false) }) — the others should match.

Fix risk: Duplicate entry — same guard/bootstrap coupling as dashboard auth wall.

Fix effort: Copy quote/page.tsx pattern: setLoading(false) or setAuthChecked(true) before return on login redirect — ~8 pages, mechanical.

lib/agent/permissions.ts getAgentSettings() (~89–97) returns DEFAULT_SETTINGS when no DB row exists — enabled_data_sources: ALL_DATA_SOURCES (picker_reports through team_chat) and viewer role with chat + memory_read enabled (~38–43, ~53–54). New companies get unrestricted agent access until a founder manually configures /controls agent settings. Enterprise default should be deny-by-default with explicit opt-in per source.

Fix risk: Fail-closed default denies agent for new companies — opposite of today's permissive first-run behavior.

Fix effort: Seed agent_settings on company create with deny-by-default sources; change getAgentSettings fallback to restrictive defaults.

Glob .github/ returns nothing. No GitHub Actions for lint, tsc --noEmit, or build on PR; no PULL_REQUEST_TEMPLATE.md; no dependabot.yml. AGENTS.md says validation is manual lint + typecheck — but nothing enforces it on push. First signal a serious product repo sends is automated CI green on main.

Fix effort: Add .github/workflows/ci.yml (lint + tsc + build), PULL_REQUEST_TEMPLATE.md, dependabot.yml.

lib/supabase/tool-reports.ts getCompanyId() (and the same pattern in shanetree-snapshots, shanetree-pull-log, shanetree-manual-subs) auto-creates a profile pointing at whichever company matches ILIKE '%greco%' when a user has no company_id. A second tenant's user hitting a warehouse tool before profile sync could be written into Greco — cross-tenant data corruption. Should fail closed instead of defaulting to one tenant.

Fix risk: Fail-closed throws break first-login warehouse tools unless onboarding creates profile first; wrong default today is the only reason some tenants work at all.

Fix effort: Change getCompanyId() to throw instead of defaulting to Greco; ~4 lib files, but must verify onboarding flow won't break legitimate first-time users.

app/api/public-tools/data/route.ts (~143) upserts created_by:'00000000-0000-0000-0000-000000000000'. Migration 076 defines created_by UUID NOT NULL REFERENCES auth.users(id). Public ToolAPI saves either fail at insert unless a system user was manually seeded, or depend on undocumented DB setup — broken or fragile public persistence.

Fix effort: Seed system user migration or make created_by nullable for anonymous public writes.

git ls-files includes SumatraPDF.exe at repo root. entree-bridge.js resolves it via join(__dirname, 'SumatraPDF.exe') (~1178). Every clone/pull ships a Windows PDF binary inside the Next.js SaaS tree — inflates GitHub/Vercel checkout, triggers security scanners, and looks unprofessional in a TypeScript product repo. Belongs in a bridge deployment bundle (S3/installer), gitignored vendor/ path, or documented optional install — not version control beside package.json.

Fix effort: git rm SumatraPDF.exe; document install in SHANETREE_REMOTE_SETUP; bridge reads env SUMATRA_PATH or vendor/ gitignored path.

Sibling /api/v1/ai/chat calls checkCompanyAIAccess(apiKey.companyId) before invoking the gateway. agent/route.ts and agent/stream/route.ts only gate on requireFeature: 'ai_analysis' — companies with AI disabled or exhausted quota can still burn tokens via v1 agent endpoints.

Fix risk: API-key agent consumers may exceed quota with no warning today — enforcement changes billing behavior.

Fix effort: Two-line import + guard at top of each v1 agent route, mirroring v1/ai/chat.

app/api/v1/tools/[id]/route.ts handleGet (~28–52) .select('*').eq('id', id).eq('company_id', apiKey.companyId) — returns tool.code full HTML (~52) with no .eq('created_by', apiKey.id) or is_public check. Any tenant API key with reports:read fetches private coworker tool source. Contrasts internal custom-tools/data route which calls verifyToolAccess.

Fix effort: Add created_by or visibility check matching session custom-tools routes.

app/api/v1/reports/analyze/route.ts calls geminiFetch() (~185) with no checkCompanyAIAccess() import or call. Tracked gaps cover session AI routes and v1 /agent, but this first-class v1 analyze endpoint (documented in openapi.json) bypasses ai_enabled, daily quota and burst limits in lib/ai/access-policy.ts.

Fix effort: Add checkCompanyAIAccess(apiKey.companyId) before geminiFetch — same pattern as v1 /ai/chat.

app/api/v1/tools/[id]/route.ts handlePut/handleDelete verify .eq('company_id', apiKey.companyId) (~81, ~104) — any API key with reports:write in the tenant can overwrite or delete any custom_tools row, including private tools created by other members. No created_by === key creator check or role gate. Intra-tenant IDOR for multi-user companies.

Fix effort: Require tool.created_by === apiKey.createdByUser or admin role on mutating routes.

GET /api/settings/api-keys and /api/settings/webhooks require only a valid session; POST/DELETE are admin-gated but GET is not. Any company viewer can enumerate key prefixes, permissions, webhook URLs, delivery stats and creator emails via the Developer page.

Fix effort: Gate GET on api-keys and webhooks routes with admin/founder role check like POST.

supabase/migrations/133_create_will_call_appointments.sql DELETE policy (~70–73) allows any company member with no role check. deleteWillCallAppointment() in lib/supabase/window-appointments.ts (~124–130) deletes by id only; WindowAdminClient.tsx exposes Delete (~317–318). Viewer accept/reject is tracked — hard delete by viewers is not.

Fix effort: Migration: DELETE policy requires role IN (admin, founder) or is_founder — match accept/reject gate.

lib/api/webhooks.ts isInternalUrl() (~113) blocks private IPs in production sendWebhook() (~147), but both test routes call fetch(webhook.url) directly with no check: app/api/v1/webhooks/[id]/test/route.ts (~60–68) and app/api/settings/webhooks/[id]/test/route.ts (~107–115). Both spread ...webhook.headers into the outbound request — user-supplied header injection. API key holder registers webhook → http://169.254.169.254/ → test endpoint probes internal infra immediately.

Fix risk: Blocking private IPs breaks webhooks pointing at internal bridge PCs that are intentional today — need allowlist for bridge subnet.

Fix effort: Call isInternalUrl() in both test routes before fetch; strip or whitelist webhook.headers keys.

app/api/email/send/route.ts verifies a Bearer session, then sends to whatever to address the client supplies with a client-chosen template and data payload. No recipient allowlist (company members, own address), no role gate — any logged-in account can drive Resend as a spam/phishing relay under FileDisplay's sending domain.

Fix risk: Recipient allowlist may block legitimate report-notification flows that email arbitrary addresses today (picker, AI summary, agent).

Fix effort: Add recipient allowlist (company members or own email), template whitelist, and optional admin role gate; ~1 route file + policy helper.

The route verifies a Bearer session, then sends to whatever `to` address the client supplies, with a client-chosen template and data payload. There's no recipient allowlist (own company members, own address) and no role gate — any account can drive the Resend integration as a spam/phishing relay under FileDisplay's sending domain. Rate limiting alone doesn't close this.

Fix risk: Duplicate — notification triggers may depend on unrestricted to: field.

Fix effort: Same as open-relay fix above.

app/api/notifications/trigger/route.ts lets any authenticated company member POST arbitrary event + data. For support_reply, mention and project_update it emails victim UUIDs from client-supplied data.userId / data.mentionedUserId with no admin role check or proof the event occurred. notifySupportReply etc. exist in trigger.ts but have zero callers outside the route.

Fix effort: Stop trusting client event payloads: verify rows exist server-side, require admin for support_reply, derive mentionedUserId from DB — route rewrite ~50–80 lines.

POST /api/public/window-appointments blocks only when an accepted row exists at date+time (~229–242). decideWillCallAppointment() flips pending→accepted with no second check for another accepted row at the same appt_date+appt_time. Multiple pending requests per slot are allowed; two staffers accepting two pendings double-books. Migration 133 indexes (company_id, appt_date, appt_time) but has no partial UNIQUE WHERE status='accepted'.

Fix effort: Check for existing accepted row in decideWillCallAppointment; add partial UNIQUE index on slot.

/api/admin/reply (app/api/admin/reply/route.ts:95–104) inserts into legacy team_chat_messages after updating team_mentions.admin_reply. Live /team-chat reads chat_rooms / chat_room_messages only. Admin replies show on dashboard/account mention cards but the parallel chat-row insert is invisible — split-brain between two table families, ~50 lines of dead insert path per reply.

Fix effort: Stop inserting team_chat_messages from admin/reply or migrate replies into chat_room_messages the UI reads.

lib/agent/tools.ts queryCalendarEvents (~805–820) uses the service-role client and selects all calendar_events for a company_id with no visibility, created_by, or participant filter (filterUserId is optional and agent-chosen). UI RLS in supabase/migrations/091_calendar_visibility_public.sql hides coworkers' personal events from viewers — the agent tool does not. Any agent-enabled user can ask for private event titles, descriptions, locations and links.

Fix effort: Mirror calendar RLS in queryCalendarEvents — filter visibility/participants before service-role select; ~1 file in lib/agent/tools.ts.

lib/agent/tools.ts queryDocuments (~678–683) selects all shared_documents for a company via service role with no sharing_mode, created_by, or shared_with_user_id filter. Bypasses document-sharing RLS from migrations 027 and 055. Agent can enumerate DM-only and private docs a viewer cannot open in /documents.

Fix effort: Apply sharing_mode + shared_with_user_id filters in queryDocuments using caller userId — match /documents page query logic.

lib/agent/tools.ts queryTeamChat (~864–881) loads every chat_rooms row for the company, then all matching chat_room_messages including user_email — no room-membership check. Any agent-enabled viewer can pull company-wide chat history via a single tool call, including DMs if stored in shared room tables.

Fix effort: Restrict queryTeamChat to rooms the caller is a member of; redact user_email for non-admin roles.

lib/agent/tools.ts sendEmailNotification() sends to whatever to address the model supplies. Guard is only userRole !== 'viewer', and v1 agent routes hardcode userRole: 'admin' — a second open-relay path beside /api/email/send with no company-member allowlist or template whitelist.

Fix risk: Tightening agent sendEmail breaks autonomous digest prompts that email external stakeholders.

Fix effort: Add company-member allowlist + template whitelist in sendEmailNotification; tie v1 agent role to API key creator's profile role.

PATCH /api/greco/analytics-log mirrors excluded flags into report tables via TOOL_TABLE_MAP[row.tool_name] (~116). Truck Errors page logs tool_name 'Returns' but the map key is 'Truck Errors' — exclude toggles update team_activity_log only, not truck_errors_reports. Same class for 'Damages' vs 'Damages Tool', 'Weekly Returns' vs 'Returns Intel', and tools absent from the map (Transfers, Routing, Thruput…). Operators think they hid a report from Daily Stats; the underlying report row stays visible.

Fix effort: Alias map Returns→Truck Errors, Damages→Damages Tool, etc.; extend TOOL_TABLE_MAP to all logged tools.

grep detectAndNotifyAnomalies across the repo finds only app/forklift/page.tsx (~724) as a caller. Picker, Loader, Shorts, Returns and the rest call logReportGeneration / notifyReportGenerated but never extract metrics or run detectAndNotifyAnomalies — so warehouse anomaly alerts and baselines are Forklift-only despite lib/supabase/anomalies.ts exporting extractPickerMetrics and extractLoaderMetrics with zero imports.

Fix effort: Wire detectAndNotifyAnomalies + extract*Metrics into picker/loader/shorts save paths; share one canonical metrics module.

AgentSettingsPanel (~592–593) promises 'Automatically generate AI insights for newly uploaded reports.' Grep: auto_summarize is read only in app/api/cron/agent-autonomy/route.ts (~35–36), which enqueues a generic digest agent_task — same path as auto_email_digest, not per-upload. No forklift/picker/shorts save path reads the flag. Toggle implies per-report AI; cron delivers a periodic digest stub.

Fix risk: Wiring toggle to uploads suddenly enables AI spend and emails users thought were decorative — product surprise.

Fix effort: Call summarize hook from saveReport paths or rename toggle to match periodic digest behavior.

supabase/migrations/043_add_file_attachments.sql creates chat-attachments and document-images buckets with public: true (~31–41). lib/supabase/chat-rooms.ts (~327–339) and documents.ts upload then getPublicUrl(). Public buckets serve files to anyone holding the URL regardless of authenticated SELECT policies — multi-tenant attachment leakage if links spread outside the company.

Fix risk: Moving to private buckets breaks existing public URLs embedded in chat history and document shares.

Fix effort: Migrate buckets to private + signed URLs in chat-rooms.ts and documents.ts upload paths.

app/tools/greco/lib/items-engine.ts fetchAllPoDetails (~1128–1149) sequentially fetches every unique PURNO via /api/entree/query?report=po-doc. A busy DockSheet day with 40–80 POs issues dozens of bridge ODBC round-trips per PDF click with no max-PO guard, timeout UX, or concurrency limit — can stall the browser and stack bridge jobs.

Fix effort: Cap max POs (e.g. 30), batch with concurrency limit, show progress/cancel — items-engine.ts + UI.

On mount, dashboard/page.tsx (~446–449) calls loadDashboardData(), loadAllTabData() and loadAdminHiddenTabs() together. loadAllTabData (~432–442) kicks off 10 parallel fetches (user files ×2, org members, team activity, mentions ×2, support unread, documents, AI conversations, custom cards, custom tools) regardless of which tab is visible. A 30s interval (~498–505) and visibility handler (~509–516) re-run loadAllTabData() — background tab churn even when the user only wants the tool grid.

Fix risk: Changing refresh intervals trades server load for stale kiosk data operators may rely on.

Fix effort: Lazy-fetch per active tab; gate 30s/visibility refresh to visible tab; combine related Supabase calls — ~1 day, medium regression risk.

Single 601 KB entree-bridge.js sits at /workspace root with start-shanetree-autoprint.bat and SumatraPDF.exe — three bridge-PC artifacts sharing top billing with README and package.json. No bridge/ or ops/ namespace separates warehouse runtime from Vercel app code. New contributors cannot tell which files deploy to Vercel vs which install on the ODBC PC. Move to bridge/entree-bridge.js (or packages/bridge) with a one-line README pointer.

Fix risk: Large single-file page — extracting or refactoring risks breaking embedded business logic.

Fix effort: Move to bridge/entree-bridge.js; update bat/ps1 paths and README; keep out of Vercel build context.

app/geronimo/GeronimoClient.tsx (~240) await import('xlsx') on user-supplied BFC Dakota files. Frozen xlsx@0.18.5 CVE is tracked generically — Geronimo is another client-side surface still using the vulnerable parser for warehouse slot data instead of exceljs.

Fix risk: Spreadsheet parser changes affect every upload tool — cell types and dates may shift.

Fix effort: Switch GeronimoClient to exceljs parse path — same migration as meat-counts/forklift xlsx CVE fix.

app/components/GrecoOnlyGuard.tsx useGrecoCheck() optimistically sets status='allowed' when fd_greco_guard_verdict_v1 is in localStorage, then returns early on missing session without downgrading if cache says allowed (lines 101–139). Deliberate warehouse UX trade-off (RLS still protects data), but /inbox then hits if (!user) return and never sets ready — infinite FancyLoader on shared PCs after the previous operator's cache.

Fix effort: Product trade-off: either clear cache on explicit sign-out only (partial), or downgrade cached-allowed when session truly absent after retries — touches warehouse UX on shared PCs.

grecoDeniedTools from getMyGrecoCardDenials() is consulted only in dashboard/page.tsx (~1562) when rendering GRECO_TOOLS cards. GrecoOnlyGuard on each /forklift, /picker, /thruput route checks company_id === GRECO_COMPANY_ID only — it never reads greco_card_permissions. An operator denied 'Forklift' in /controls can still deep-link or bookmark the route and use the tool; hiding is cosmetic on the Tools tab.

Fix effort: Pass denied tool routes into GrecoOnlyGuard or shared hook; block direct URL access when tool:<route> denied.

The DockSheet session table — arguably the most load-bearing table in the app — has no CREATE TABLE in supabase/migrations/, so its indexes and RLS aren't versioned or reviewable, and a fresh environment can't be reproduced from the repo. A snapshot migration (even retroactive) would fix that. A couple of composite indexes are also missing elsewhere (shanetree_pull_log and shanetree_snapshots order by created_at within a company without a matching composite).

Fix risk: Same as versioned-migration gap — fresh env vs prod parity; altering live table affects all dock kiosks.

Fix effort: Same retroactive migration task.

grep 'create table.*greco_cindyvue_sessions' in supabase/migrations/ returns zero CREATE TABLE — only comments in 115_create_return_diffs_snapshots.sql and 129_create_driver_chat.sql reference the name. CindyVueClient.tsx (~4749–4763) and POST /api/greco/session assume the table exists. Fresh supabase db reset from repo migrations never creates it; indexes and RLS aren't reviewable in git history.

Fix risk: Retroactive migration on a live JSONB table risks downtime; dock floor depends on this table every shift.

Fix effort: Retroactive CREATE TABLE migration from prod schema dump + document indexes/RLS — no app code change but needs careful SQL review.

app/api/internal/webhooks/trigger/route.ts (~80–87) allows founder/admin/editor roles. Body fields (tool_name, report_id, summary, ai_analysis) are client-supplied with no proof a report was generated. Any editor can enqueue signed webhook deliveries. Tracked rate-limit gap names the route; this is the forgery/trust angle parallel to /api/notifications/trigger.

Fix effort: Verify report_id exists server-side before enqueue; restrict to service-role internal path only.

MemberPermissionsSection and account/page.tsx persist can_edit_email_settings, can_edit_ai_filters and can_edit_report_settings via lib/supabase/member-permissions.ts. getMyFullPermissions() returns canEditEmailSettings, canEditAIFilters and canEditReportSettings, but grep across app/ finds zero reads of those fields. Dashboard only consumes toolAccess (~1566); tool pages use canViewAnalytics/canViewAI only. Restricting 'Email Settings' in Controls has no effect anywhere.

Fix risk: Wiring latent toggles suddenly enables or blocks behavior users assumed was active.

Fix effort: Gate email/AI/report settings UI with canEdit* from getMyFullPermissions() on dashboard and tool pages.

lib/supabase/member-permissions.ts ALL_TOOLS (~48–59) seeds only ten legacy analytics tools. lib/greco/greco-tools.ts registers 29 routes (Thruput, Driver Chat, Routing, Negative Slots, etc.). Controls cannot restrict access to tools outside the stale list — getDefaultToolAccess() only knows the ten names. Permission UI appears comprehensive but covers <35% of the warehouse grid.

Fix effort: Generate ALL_TOOLS from GRECO_TOOLS + non-Greco tools; migrate existing permission rows.

Passes 1–8 track Forklift processor only, but the same new Date().toISOString().split('T')[0] / .slice(0,10) pattern is verified in picker (~1167, ~2158), shorts (~3934), skips (~556, ~727, ~1149), replen (~567, ~856), loader (~343, ~872), returns (~911), truck-errors (~660, ~976), damages (~375), reconciliation (~344, ~772), returns-intel (~420, ~917), thruput (~177) and forklift page (~597, ~1209). Eastern evening uploads land on tomorrow's calendar day for leaderboards, filters and anomaly baselines across the grid.

Fix risk: Cross-tool date alignment touches picker, shorts, loader, forklift processors — partial fix leaves tools disagreeing on 'today'.

Fix effort: Shared warehouseLocalDate() helper; replace ~15 tool save paths (beyond forklift processor).

package.json scripts: dev, build, start, lint only — no test, typecheck, or format. No test/, e2e/, vitest.config, playwright.config, .prettierrc, or .editorconfig. tsconfig strict is good, but repo offers no automated safety net before refactor. Pairs with EntreeClient 41k-line monolith — structure without tests reads as high-risk to external reviewers.

Fix effort: Add npm run typecheck, vitest scaffold, prettier + editorconfig — even smoke tests raise professionalism.

lib/notifications/webhooks.ts notifyReportCompleted() is only called from app/forklift/page.tsx. Other warehouse tools (picker, shorts, skips, replen, etc.) call notifyReportGenerated() for email only — Developer-configured report.completed webhooks never fire for those tools.

Fix effort: Call notifyReportCompleted/Failed from each warehouse tool save path (or centralize in notifyReportGenerated).

app/timer/TimerClient.tsx loadSession (~327–333) fetches greco_cindyvue_sessions.list_data via unauthenticated GET /api/greco/session?date=…. Every saved appointment (vendor, carrier, dock, door, notes, times) lands in browser memory; only the search UI narrows to rows with PO#s (~437–440). World-readable session GET is tracked separately — this is timer-specific disclosure of the entire receiving schedule to anyone with the public link.

Fix effort: Server-side PO-only projection endpoint for /timer, or auth-gate session GET — reduce public roster exposure.

GET /api/public/driver-chat?sessionDate=…&apptId=… (app/api/public/driver-chat/route.ts ~62–100) returns the full thread plus all messages with no auth — by design for /timer, but any holder of a dock appointment id can read driver↔Greco chat history. appt_id is a small integer from DockSheet rows, so enumeration across session dates is feasible. Separate from tracked public relay rate limits — this is an unauthenticated read disclosure.

Fix risk: Driver kiosk /inbox public path depends on unauthenticated read — auth breaks driver workflow on shared phones.

Fix effort: Require kiosk token, signed appt token, or rate-limited short-lived read secret; document threat model.

checkCompanyAIAccess() in lib/ai/access-policy.ts is enforced on /api/v1/ai/chat and the IDE assistant but not on /api/agent/chat, ai-analyze, ai-summary, routing/ai-build, greco/analytics-chat, port/ai-summary or custom-tools/generate. The policy itself fails open on read errors (returns allowed: true at lines 41–44), so disabled companies or quota exhaustion may not block UI-driven AI calls.

Fix risk: Enforcing checkCompanyAIAccess() on UI AI routes may disable AI customers already rely on while policy read errors still fail open today.

Fix effort: Import checkCompanyAIAccess into ~7 session AI routes; also fix fail-open read error in access-policy.ts — repetitive but each route needs a quick test.

Only Driver Scan CDN load is tracked in pass 18. Same pattern in app/licenses, negative-slots, empty-slots, forklift, picker, shorts, skips, returns, truck-errors, replen, reconciliation, loader, damages, shrink-meeting, returns-intel, scan and build pages — all inject https://cdnjs.cloudflare.com/ajax/libs/exceljs/4.3.0/exceljs.min.js with no integrity attribute. Dock-floor xlsx parsing depends on a third-party CDN across the warehouse suite.

Fix risk: Bundling ExcelJS locally increases tool page JS weight — tablets on slow Wi-Fi may timeout.

Fix effort: Bundle exceljs via npm in shared hook or add SRI to all 17 script injections — wide touch, test each tool export.

EntreeClient.tsx todayStr() (~545) returns new Date().toISOString().slice(0,10) and seeds dozens of modal date ranges (adjustments, routes, will-calls, venpic…). autoPullEngine.ts duplicates the same helper (~54–55) for daily-gate localStorage keys. ODBC pulls opened after 7–8pm Eastern default to tomorrow's calendar day before the operator touches the picker — mismatches dock-floor 'today' and CindyVue session_date.

Fix risk: Date boundary changes reorder stats, leaderboards, and filters keyed on existing date columns.

Fix effort: Shared warehouseLocalDateStr() in EntreeClient + autoPullEngine; replace toISOString().slice(0,10).

supabase/migrations/123 shanetree_relay_claim() selects oldest pending rows globally with no company_id filter. Any bridge holding INTERNAL_API_SECRET can dequeue another tenant's ODBC relay jobs — multi-tenant isolation depends on there being only one bridge today.

Fix effort: Add company_id param to shanetree_relay_claim() RPC + filter pending rows; bridge must send tenant context.

Account ALL_DASHBOARD_TABS (~161–168) and Controls TabVisibilitySection (~15–23) let admins hide projects, tools, reports, members, chat, history and stats. Current dashboard tab strip uses overview, developer, build, tools, workspace, reports and godview — members/chat/history moved under Workspace or separate routes. Five of seven visibility toggles name tabs that are not in the tab bar anymore; admins think they hid Chat while /team-chat links remain.

Fix risk: Rewiring to Workspace folder changes which cards Controls hides — saved JSON keys may orphan.

Fix effort: Realign ALL_DASHBOARD_TABS / CONTROLLABLE_TABS to overview|developer|build|tools|workspace|reports|godview + workspace sub-routes.

app/thruput/page.tsx calls saveThruputWeek/saveThruputDay/getThruputWeeks/getThruputDays from lib/supabase/tool-reports.ts (~2075–2165), which upsert into thruput_days and thruput_weeks. supabase/migrations/132_create_thruput_tables.sql is an empty comment stub (tracked in Hygiene) — no CREATE TABLE ever ran. Operators can edit the throughput board for a session, but persistence either fails silently or depends on tables created outside the repo.

Fix risk: Running stub migration 132 on prod may conflict with hand-created tables or wrong alphabetical apply order.

Fix effort: Fill 132_create_thruput_tables.sql with thruput_days/weeks DDL + RLS; verify saveThruputDay/Week against fresh DB.

Dashboard lets admins configure per-tool email recipients (report_email_recipients via getEmailRecipients in lib/supabase/report-email-recipients.ts), but UI-generated reports call notifyReportGenerated() → /api/notifications/trigger which loops every company member with only the global report_notifications opt-in. Per-tool recipient config is never read on the UI notification path.

Fix effort: Wire getEmailRecipients(toolName) into /api/notifications/trigger report_generated case instead of looping all members.

app/api/v1/agent/route.ts and agent/stream/route.ts pass userRole: 'admin' to runAgent/runAgentSync regardless of who created the key or their profile role. External API consumers get full agent tool permissions through any valid API key.

Fix risk: Mapping API key to real role breaks integrators that depend on admin-level agent tools via any key.

Fix effort: Map API key creator's profile role (or scoped key permissions) into runAgent; may need new api_keys.permission_level column.

TOOL_TABLE_MAP in app/api/v1/export/route.ts (~24–35) lists forklift, picker, replen, returns, shorts, skips, truck_errors, reconciliation, loader and returns_intel. lib/greco/greco-tools.ts registers 29 routes. Exporting damages, cyclecount, drivers, thruput, etc. returns 400 'Unknown tool.' OpenAPI /api/v1/export documents no such limitation — API contract overpromises warehouse coverage.

Fix effort: Expand TOOL_TABLE_MAP to all report tables or document allowed tools in OpenAPI enum.

app/api/v1/reports/analyze/route.ts — send_email defaults true (~254); email_recipients accepts arbitrary addresses (~262–264); emails send via direct Resend fetch (~290–301) with no domain allowlist. Any API key with reports:write can email AI summaries to external addresses under the platform From domain.

Fix risk: External API consumers may rely on emailing non-member addresses — contract change needs version bump.

Fix effort: Restrict email_recipients to company members or configured per-tool list; disallow arbitrary external addresses.

AgentSettingsPanel (~608–609) says 'Send weekly summaries to configured recipients.' Cron runs every 10 minutes (vercel.json */10), not weekly. agent-autonomy/route.ts only changes the prompt string (~88–90); agent-task worker persists agent_tasks.output with no Resend/sendEmail call. digest_recipients is never read in cron or worker. Users enable weekly email; they get at most a background task row.

Fix risk: Implementing cron email may flood recipients who enabled toggle expecting silence — digest_recipients unused today.

Fix effort: Wire agent-task digest completion to Resend using digest_recipients; run cron weekly not */10.

Return Diffs uses normCust stripping leading zeros (EntreeClient.tsx ~20748). /reconciliation keys on raw customer strings from fixed xlsx column positions (~249, ~282). Returns Intel keys on BFC Client ID. Employee names on BFC forklift/picker exports have no mapping to Entrée SECID. Enterprise software needs lib/identifiers/customer.ts (and employee.ts) consumed by every join — today each tool reinvents string cleanup.

Fix effort: lib/identifiers/customer.ts + employee.ts with normCust, bfcClientToCustno, bfcNameToSecid — wide refactor across join sites.

POST /api/greco/session upserts greco_cindyvue_sessions on onConflict: 'session_date' only (~176–186) — no row-level version or editor lock. CindyVueClient runs a 30-second autosave setInterval (~1389–1398) calling syncToBackendRef. Two receivers editing the same session_date overwrite list_data/grid_data wholesale; combined with world-readable GET (tracked elsewhere) any kiosk can also clobber in-flight edits.

Fix risk: Adding versioning/locks changes autosave semantics; two receivers editing same day is common — naive fix can block saves or duplicate rows.

Fix effort: Optimistic locking (updated_at check), editor presence, or merge strategy before upsert on session_date.

/controls Greco Tools matrix (ToolsAccessSection.tsx ~12–16) keys denials by route (/forklift, /picker) in greco_card_permissions. Legacy Member Permissions keys by display name ('Forklift Productivity') in member_permissions.tool_access. Same member can be denied in one system and allowed in the other. Distinct from tracked ALL_TOOLS 10-vs-29 completeness gap — both systems are live with different namespaces.

Fix risk: Merging Controls matrix with greco_card_permissions changes which gate wins — latent denies or grants flip.

Fix effort: Unify on route keys everywhere or map display names ↔ routes in one permission service.

app/picker/page.tsx is BFC EPM picker-report upload only — grep finds zero entree/ODBC/picker-report references. Window Picker Production modal pulls live /picker-report via ODBC and autoPullEngine writes pickerProduction snapshots to shanetree_snapshots (~298–300). picker_reports (BFC metrics) and shanetree_snapshots (ODBC production) sit in separate buckets on Daily Stats with no merge, employee crosswalk, or deep-link between the two surfaces.

Fix risk: Unifying pipelines touches Window ODBC path and BFC picker_reports schema — operators use both independently today.

Fix effort: Unified picker analytics: merge picker_reports + pickerProduction snapshots on employee crosswalk; add ODBC fetch option to /picker or deep-link from dashboard.

lib/supabase/tool-reports.ts upsertDailyStat/getDailyStats and app/api/cron/greco-digest/route.ts read greco_daily_stats extensively; lib/agent/greco-tools.ts treats it as a first-class agent query target. Grep greco_daily_stats in supabase/migrations/ returns zero CREATE statements — schema exists only in hosted Supabase or manual DDL. Fresh environments cannot reproduce Daily Stats, dockvoo rollups or the digest cron from migrations alone.

Fix effort: Author migration with company_id, RLS, indexes and dockvoo JSONB columns matching tool-reports.ts; backfill from hosted schema.

app/history/page.tsx (~177) calls getUnifiedHistory(0) when loadLimit is 'all'. lib/supabase/unified-history.ts (~217) documents limit<=0 as intentional zero-cap across four sources: team_activity_log (getTeamActivity), DockSheet dock events (greco session API), shanetree_print_log (listPrintLog), shanetree_pull_log (listPullLog) — merged in browser newest-first. handleExportExcel (~175–177) also forces getUnifiedHistory(0) even when UI shows 50 rows. At warehouse volume → multi-megabyte fetch and frozen tab.

Fix risk: Same unbounded ledger fetch — export and deep-link flows depend on zero cap.

Fix effort: Server-side cursor pagination across four merged sources in unified-history.ts + history page UX — non-trivial merge semantics.

Layout pass on Jul 2026 checkout: ~11 MB SumatraPDF.exe + 588 KB entree-bridge.js + Windows kiosk scripts committed at repo root; 79 flat app/ routes with no domain grouping; dual component trees (components/ vs app/components/); 43 flat lib/supabase modules; four nested app/**/lib/ folders beside top-level lib/; seven scattered root markdown guides with no docs/ directory; no .github/ CI or templates; no test/, typecheck script, Prettier, or EditorConfig; supabase/migrations/README still documents migrations 001–011 while 150 SQL files exist; misleading ALL_MIGRATIONS_COMBINED.sql (11 migrations only). Clone size, onboarding friction, and 'is this a product or a bridge PC dump?' signals stack up before a reviewer reads application code.

Fix effort: Phased restructure: bridge/ ops bundle, docs/ hub, .github CI, delete SumatraPDF from git, route groups — multi-PR layout pass.

Reconciliation normalizes 7-digit POs with SS/RMR/FPD rules (app/reconciliation/page.tsx ~189–201). Daily Items/DockSheet use Greco PURNO matching ^6\d{5}$ (shanetree-whitepaper glossary ~163). BFC returns use Cust Order as original invoice, not PURNO. Return Diffs parses ORIG_INVNO from credit-memo PONUM/REFNO. No lib/identifiers/po.ts resolver spans all three namespaces — enterprise merge needs one canonical PO/invoice crosswalk.

Fix effort: lib/identifiers/po.ts with normalizePo(), parseOrigInvno(), grecoPurno() — consumed by reconciliation, Return Diffs, Daily Items, DockSheet.

GET/POST /api/public-tools/data authenticate only by share_id (no user token). Anyone with a published link can read all keys (key=_all) and upsert up to 1MB per key into custom_tool_data for that tenant via service role. Enables data poisoning, PII stuffing and storage-cost abuse against public tools wired through app/t/[id]/page.tsx.

Fix effort: Require signed write tokens, rate-limit writes harder, or separate read-only public data plane.

Window Return Diffs (EntreeClient.tsx ~9890–9903) matches BFC returns xlsx (drag-drop) to live /return-diffs ODBC credit memos on (ORIG_INVNO, item) with (custNo, item) fallback; snapshots land in return_diffs_snapshots. Standalone /reconciliation instead joins two manual xlsx files on customer|item (app/reconciliation/page.tsx ~257–305) with different PO normalization rules (~189–201). Operators must pick one reconciliation philosophy; neither tool reads the other's output or snapshots.

Fix effort: Deprecate /reconciliation or redirect to Window Return Diffs join keys; migrate customer|item users to ORIG_INVNO|item model — operator training + data parity testing.

EntreeClient.tsx statically imports DiamondReportPanel (~2,532 lines, recharts), InvoicePanel, CustomerPanel, MapPanel, ProducePanel, StockVooPanel, SalesDistributionPanel (~recharts), PullLogPanel, BridgeRelayPanel, PortAISummaryModal, and more — none behind dynamic(). Roughly half the Entree file count is pulled in before the operator taps a tile. Splitting panels behind dynamic(() => import(...), { ssr: false }) per modal would cut initial JS substantially.

Fix effort: Wrap each panel in next/dynamic() with ssr:false — ~15 imports in EntreeClient.tsx; test every modal open path on relay and full modes.

/history's “All” mode calls getUnifiedHistory(0), which deliberately applies no .limit() across four sources (team_activity_log, dock events, print log, pull log) and merges them in the browser. Fine today; at a year or two of warehouse volume it becomes a multi-megabyte fetch and a frozen tab. Needs server-side pagination or a cursor — same pattern exists in getTeamActivity, listPullLog, and the session ?list=history&limit=0 API path.

Fix risk: Capping getUnifiedHistory breaks 'Download entire history' contract and deep-link highlight that forces load-all.

Fix effort: Same pagination refactor.

package.json pins xlsx@^0.18.5 — the last version SheetJS ever published to npm, affected by CVE-2023-30533 (prototype pollution when reading crafted spreadsheets). Patched builds exist only on the SheetJS CDN. It's used server-side in ai-summary and the forklift processor and client-side in meat-counts — all parsing user-supplied files. Migrate those call sites to exceljs (already installed) or the CDN build.

Fix risk: exceljs migration changes parsed cell types and date serials across forklift, meat-counts, ai-summary — all user uploads need regression pass.

Fix effort: Same exceljs migration.

lib/tools/registry.ts ends at 10 entries (forklift through returns_intel). Missing damages, shrink-meeting, transfers, cyclecount, drivers, thruput, licenses, geronimo, empty_slots, etc. app/scan/page.tsx and v1 tool-detection cannot route uploads to those tools. Distinct from tracked /scan re-implementation — even a fixed detector cannot target unregistered tools.

Fix effort: Register remaining Greco tools in lib/tools/registry.ts with column signatures — wide effort, enables scan routing.

Three naming layers disagree: lib/greco/greco-tools.ts card 'Returns' (route /truck-errors) vs member-permissions ALL_TOOLS 'Truck Errors' vs logReportGeneration('Returns') in truck-errors/page.tsx (~733). 'Damages' card vs analytics-log TOOL_TABLE_MAP key 'Damages Tool'. 'Weekly Returns' card vs logReportGeneration('Weekly Returns') vs TOOL_TABLE_MAP 'Returns Intel' vs returns-intel save toolName 'Returns Intel'. Returns+ logs both 'Returns+' and 'Returns Tool'. Filters, permission matrices and analytics-log PATCH mirroring cannot stay aligned without a single canonical tool_name registry.

Fix risk: Deduping parallel implementations must update every copy or behavior drifts again.

Fix effort: Single TOOL_NAME registry consumed by greco-tools, logReportGeneration, analytics-log TOOL_TABLE_MAP and member-permissions.

package.json pins xlsx@^0.18.5 — last SheetJS npm publish, affected by prototype-pollution CVEs on crafted spreadsheets. Patched builds exist only on SheetJS CDN. Used server-side (ai-summary, forklift) and client-side (meat-counts) parsing user files. exceljs is already installed as alternative.

Fix risk: Same CVE pin — SheetJS API differences break header detection if rushed.

Fix effort: Migrate every xlsx call site to exceljs (already installed): forklift processor, ai-summary, meat-counts, any others — API differences, regression-test all upload flows.

.gitignore whitelists .env.local (“Safe because this GitHub repo is PRIVATE”), verify-architecture.ps1 actively fails unless it's tracked, and the file contains a real 64-char INTERNAL_API_SECRET used by /api/internal/*, tool generation and the bridge relay. That's a deliberate trade-off for the SentinelOne-wipes-the-bridge-PC problem, but one repo-visibility mistake, fork, or leaked clone exposes service-to-service auth. The secret should live in Vercel/bridge env stores and be rotated.

Fix effort: Same ops overhaul as above.

.gitignore lines 37–41 explicitly un-ignore .env.local ('Safe because this GitHub repo is PRIVATE'). The file is present in the checkout and carries live secrets (INTERNAL_API_SECRET for /api/internal/*, tool generation, bridge relay). One visibility change, fork, or leaked clone exposes service-to-service auth. Secrets belong in Vercel/bridge env stores with rotation, not version control.

Fix effort: Ops/process change: rotate INTERNAL_API_SECRET, move secrets to Vercel + bridge env, un-whitelist .gitignore, update verify-architecture.ps1 — not just a code diff.

lib/shanetree/shanetree-whitepaper.ts dataBoundaries (~99–123): Window never streams live ODBC to the internet; snapshots are point-in-time sign-off. whitepaper-unified.ts Return Diffs bullets say weekly reconciliation 'without writing back to Entrée.' BFC has no API hook at all. Low Slots PICK lists, Return Diffs resolutions, and Shorts comparisons inform operators but cannot close the loop in either system — enterprise merge eventually needs governed write-back or at least export formats both systems ingest.

Fix effort: Product decision + bridge work: governed export formats, Entrée adjustment import path, or BFC API if available — months, not a code-only fix.

Greco warehouse tools overwhelmingly ingest manual BFC xlsx exports (documented per-tool in app/docs/page.tsx 'How to Pull This from BFC'). Shanetrée/Window reaches Entrée only via entree-bridge.js ODBC (/api/entree/query). There is no scheduled BFC ingest, no item-master sync, and no canonical crosswalk table linking BFC export schemas to Entrée tables (arinvt01, arslot, arcusto). Enterprise merge requires a shared identifier spine — today every join is bespoke per tool.

Fix effort: Platform architecture: lib/identifiers registry, BFC ingest layer, Entrée ODBC facade, and join contracts — weeks of product + schema design before tool-by-tool wiring.

supabase/migrations/014_update_ensure_user_profile.sql (~47–61) — unrecognized domains get a new companies row (INSERT INTO companies (name, domain)). Any signup with @gmail.com, @competitor.com, etc. spawns a tenant and makes the first user founder. Enterprise SaaS expects allowlisted domains or invite-only onboarding, not auto-provisioning.

Fix effort: Product decision: domain allowlist, invite-only signup, or pending-approval state — migration + signup flow change.

app/entree/EntreeClient.tsx is 41,917 lines — one 'use client' component holding Shanetrée routing, ODBC pulls, will-calls, print queues, relay mode, and a dozen modals. No next/dynamic() panel imports; ExcelJS/xlsx are dynamically imported at call sites but the component tree itself is monolithic. Every /entree visit parses and hydrates the full module before the home grid renders.

Fix risk: Code-splitting or moving hooks changes /port, /noe, /adrian kiosk mounts that import the full chunk — regression surface is the entire ERP UI.

Fix effort: Architectural decomposition: extract panels/routes into lazy chunks — weeks of careful work with high regression risk on dock-floor Shanetrée.

lib/jobs/service.ts WORKER_ROUTES lists report_processing → /api/jobs/workers/report, embedding_generation → /embedding, scheduled_report → /scheduled-report, data_export → /export and cleanup → /cleanup. Glob finds only six workers (email, webhook, batch-email, anomaly, ai-analysis, agent-task). v1 export and schedules enqueue data_export / scheduled_report jobs that will 404; /api/jobs/enqueue allows embedding_generation and report_processing with the same fate. Broken async surface for API consumers.

Fix effort: Implement five worker route handlers or remove job types from WORKER_ROUTES, enqueue allowlist and v1 export/schedules.

POST /api/v1/schedules inserts into job_schedules with next_run_at, cron_expression and job_type scheduled_report (app/api/v1/schedules/route.ts ~162–177). Grep finds only the v1 schedules routes touch job_schedules — vercel.json has no cron that polls due schedules. Combined with the missing /api/jobs/workers/scheduled-report worker (pass 7), the Schedules API is write-only: API consumers can create schedules that never fire.

Fix effort: Add cron to poll due job_schedules + implement scheduled-report worker, or remove v1 schedules API.

Window Low Slots pulls Entrée demand via bridge /low-slots (artrans/arytran/arslot + arinvt01 on-hand) and optionally merges BFC Dakota Slot Listing (R08921s) in-browser (lib/lowslots/dakota-merge.ts). PICK list exports save to shanetree_snapshots (modal_key lowSlotsPickList); Shorts reads those snapshots for next-morning comparison. This ODBC+demand+BFC-physical+snapshot pattern is exactly what enterprise WMS↔ERP intimacy looks like — but Forklift, Picker, Replen, Returns Intel, Transfers and most other Greco tools are upload-and-forget BFC analytics with zero Entrée join.

Fix risk: Extending Dakota merge pattern to other tools requires EntreeClient coupling — partial port breaks parity.

Fix effort: Replicate ODBC+demand+BFC-physical+snapshot pattern across Forklift/Picker/Replen/etc. — per-tool ODBC endpoints + snapshot keys; use Low Slots as template.

lib/shanetree/shanetree-whitepaper.ts and app/docs/page.tsx document individual tools well. SHANETREE_REMOTE_SETUP.md covers bridge tunnels only. app/developer/page.tsx mentions 'WMS/ERP integrations' via API keys but implements no unified merge layer. Started wins (Low Slots+Dakota, Return Diffs, Shorts↔PICK) prove the pattern works — what's missing is a platform plan: identifier registry, shared join library, ODBC+BFC ingestion matrix per Greco tool, and deprecation path for duplicate reconcilers (/reconciliation vs Return Diffs, /picker vs Picker Production).

Fix effort: Document merge matrix (tool × BFC input × ODBC endpoint × snapshot × write-back) and deprecation list — product/engineering planning artifact.

grep '/api/admin/projects' across app code finds only app/api/admin/projects/route.ts. Dashboard loads quotes via /api/admin/submissions (~1387); quotes-admin uses direct Supabase. Orphan admin route with project-message join logic maintained beside the live submission path.

Fix effort: Delete route or wire dashboard projects tab to it instead of submissions-only path.

Only app/forklift/page.tsx calls notifyReportCompleted() today; when invoked, /api/internal/webhooks/trigger has no withRateLimit (unlike /api/notifications/trigger). A buggy Forklift loop or future wider adoption could enqueue unbounded webhook delivery jobs.

Fix effort: Wrap with withRateLimit like notifications/trigger.

Route exists with bridge proxy logic and .env.example still lists it as a live proxy, but grep finds no fetch('/api/public/will-call-items') in app code. /sales loads line items via /api/public/sales-relay (SalesClient.tsx ~878+). Comment in sales still references will-call-items 'when missing' but code path never calls it — stale docs + dead route.

Fix effort: Delete route and remove from .env.example / protected-paths, or wire SalesClient fallback.

Public will-calls (/noe) and routes/vendor-pickups (/adrian) kiosks are documented in /docs and ArchitectureDiagram but grep finds no entries in lib/greco/greco-tools.ts GRECO_TOOLS cards. Same discoverability class as tracked /port gap — floor staff must know URLs; no dashboard or tools-grid entry for two heavily documented public kiosks.

Fix effort: Add GRECO_TOOLS cards or Workspace kiosk folder linking /noe and /adrian.

loadStats (~162–166) counts profiles and companies via user-scoped Supabase client — RLS returns one company. Cards labeled like platform-wide signups/client IDs are actually company-scoped counts on a page styled as global admin.

Fix effort: Relabel stat cards or fetch via GodView service-role endpoint.

supabase/migrations/132_create_thruput_tables.sql is a single-line comment — no CREATE TABLE. Prefix 132 collides with 132_add_item_alert_stages.sql (alphabetical apply order picks _add_ before _create_). app/thruput/page.tsx + lib/supabase/tool-reports.ts saveThruputWeek/Day (~2075–2165) target thruput_days/thruput_weeks. Fresh migration runs never create those tables; throughput board edits fail or rely on hand-run SQL outside repo history.

Fix effort: Delete stub or fill with real CREATE TABLE; resolve duplicate 132 prefix.

app/api/cron/activity-log-cleanup/route.ts ~42 uses .limit(10_000) per daily run. If more than 10k rows exceed the 365-day cutoff, remainder waits for subsequent days with no overflow logging in the JSON response. High-volume warehouse tenants can leave a growing tail of expired activity.

Fix effort: Loop until batch empty or log remaining count in cron JSON response.

app/api/cron/ai-usage-rollup/route.ts monthly rollup loop awaits ai_usage_monthly_rollups upsert without checking error. Returns { success: true, companiesRolledUp: N } even when individual upserts fail — GodView AI usage dashboards can drift from raw ai_usage_logs.

Fix effort: Check upsert error per company; increment failed count in response.

File header says 'COMPLETE MIGRATION FILE' and 'combines all 11 migrations' (~403 lines) while 139+ numbered migrations exist with 13 duplicate prefixes (027, 028, … 132). Filename implies one-shot fresh install; reality is a historical artifact from early multi-tenancy bootstrap. Rename to 001-011_legacy_combined.sql or delete to avoid false confidence on new environments.

Fix effort: Rename to 001-011_legacy_combined.sql or delete; add warning header if kept.

app/docs/ArchitectureDiagram.tsx ~1117: 'Nightly /api/cron/greco-digest rolls up the day and emails stakeholders.' app/api/cron/greco-digest/route.ts only calls addMemoryEntry/searchMemory (~161–237) — grep finds no email import or send in that file. Docs overstate nightly email delivery; operators configuring around that flow are misled.

Fix effort: Fix ArchitectureDiagram copy or add email step to greco-digest cron.

app/docs/ArchitectureDiagram.tsx (~1102–1106) claims /returns-intel ingests weekly BFC truck-errors and feeds return_diffs_snapshots. Actual flow: BFC xlsx drag-drop in Window Return Diffs modal + /return-diffs ODBC → return_diffs_snapshots (EntreeClient.tsx ~9890+). /returns-intel writes returns_intel_reports only. Wrong docs slow enterprise merge work — new integrators will wire the wrong tables.

Fix effort: Fix ArchitectureDiagram.tsx Return Diffs flow arrow — point at Window modal + return_diffs_snapshots, not /returns-intel.

app/build/page.tsx error banner uses max-w-[100px] truncate on mobile (~1695–1696) while desktop gets max-w-xs. Failed generation messages (API errors, validation text) are clipped to ~100px — operators on phones see 'Gener…' instead of the actionable error string.

Fix effort: Remove max-w-[100px] on mobile error banner; use multi-line text or expandable error panel.

EventForm in app/calendar/page.tsx (~128) sets date via defaultDate.toISOString().split('T')[0]. Evening local times can show tomorrow in the date input before the operator adjusts — distinct from warehouse report_date UTC issues but same operator confusion on a collaboration surface.

Fix risk: Date boundary changes reorder stats, leaderboards, and filters keyed on existing date columns.

Fix effort: Use warehouse-local date helper in EventForm default date state.

app/controls/ControlsClient.tsx sets role='viewer' when getUser() returns null (lines 87–88) and renders the 'Controls are admin-only' card — no /login redirect. Logged-out visitors see a misleading access-denied screen instead of the login page.

Fix effort: router.push('/login') when !user instead of setRole('viewer') in ControlsClient.tsx.

app/api/custom-tools/generate/route.ts and generate-from-file/route.ts run multi-phase gateway calls (timeoutMs up to ~55s per phase, up to 4 phases) but export no maxDuration. On Vercel, platform defaults can kill mid-pipeline → flaky 504s from Build and /vibe file/prompt modes.

Fix effort: export const maxDuration = 90 on generate + generate-from-file routes.

app/items/page.tsx calls logReportGeneration('Daily Items', …) (~349) with blob size 0 and never notifyReportGenerated. Print Schedule (app/schedule/page.tsx ~244–252) does both. Per-tool email recipients and webhook subscribers never fire for Daily Items runs despite being a core receiving document.

Fix effort: Call notifyReportGenerated after logReportGeneration in app/items/page.tsx.

activeTab === 'build' (~2162–2193) only links to /vibe and /ide. The standalone /build page (file/prompt custom-tool generation, refine, publish) is the third build surface but has no card in the Build hub — users who land on the dashboard Build tab never discover the main tool builder unless they know the URL.

Fix effort: Add third Build hub card linking to /build with description distinct from Vibe and IDE.

Audit tab 'Tab bar mixes tabs with links…' is marked fixed with ↗ on Account, AI, Docs, Shanetrée, DockSheet and Support. app/dashboard/page.tsx tab strip (~1768–1910) has zero ↗ characters — in-place tabs and <Link> navigations look identical again. Users can't tell Overview/Tools/Workspace/Reports (stay on dashboard) from Account/Chat/Docs/Entree (leave page) before clicking.

Fix effort: Re-add ↗ suffix to dashboard tab-bar <Link> entries (Account, Chat, Docs, Entree, DockSheet, etc.) per audit fix.

app/tools/greco/CindyVueClient.tsx ~334–338: fetch('/api/greco/custom-appointments') uses .catch(() => {}) with no error state. Failed load renders empty appointment list indistinguishable from 'no custom appointments' — operators may think the feature is unused when the API failed.

Fix effort: Surface fetch error inline in CindyVueClient custom-appointments section.

CindyVueClient.tsx (~855) calls upsertDailyStat(dateStr, 'dockvoo', statPayload).catch(() => {}) with no toast or retry. Failed greco_daily_stats writes leave Daily Stats and greco-digest blind to dock metrics while the DockSheet UI still shows live counts — silent divergence between floor view and analytics rollups.

Fix effort: Surface upsertDailyStat failure in CindyVue sync banner instead of .catch(() => {}).

app/api/notifications/document/route.ts increments emailsSent after fetch('https://api.resend.com/emails') without checking response.ok. A 401/422 from Resend still returns { success: true, emailsSent: N } to the caller.

Fix effort: if (!response.ok) skip emailsSent++ in notifications/document/route.ts.

app/driver-scan/DriverScanClient.tsx — saveDriverScanReport(...).catch(() => {}) and upsertDailyStat(...).catch(() => {}) (~231–232). Cloud save/My Reports paths surface warnings (~212–214), but driver_scan_reports and greco_daily_stats fail with zero UI feedback — analytics blind to failed saves.

Fix effort: Surface toast on saveDriverScanReport/upsertDailyStat catch — match cloud-save warning pattern.

lib/email/service.ts sendWithResend() logs [EMAIL] RESEND_API_KEY prefix: with the first six characters on every send attempt. Server logs (Vercel drains) become a partial secret oracle — separate from the Sentry replay issue.

Fix effort: Delete the RESEND_API_KEY prefix console.log in lib/email/service.ts line 172.

lib/supabase/member-permissions.ts exports canAccessToolAnalytics() (~335), canAccessToolAI() (~363), canEditEmailSettings() (~391) and canEditAIFilters() (~419) with zero external callers. Tool pages use getToolPagePermissions() instead; canEdit* fields on getMyFullPermissions() are already tracked as unread — these standalone async wrappers are a second dead layer on top.

Fix risk: Wiring latent toggles suddenly enables or blocks behavior users assumed was active.

Fix effort: Remove canAccessToolAnalytics, canAccessToolAI, canEditEmailSettings, canEditAIFilters from member-permissions.ts; callers already use getToolPagePermissions / getMyFullPermissions.

app/geronimo/GeronimoClient.tsx logs + notifyReportGenerated (~673–674) but never upsertDailyStat. app/licenses/page.tsx (~440–447) and app/negative-slots/page.tsx (~461–468) same pattern. Empty Slots gap is tracked separately. All three are absent from DailyStatsClient TOOL_META (~62–80) — digest cron and Daily Stats grid stay blind.

Fix effort: Add upsertDailyStat on save + TOOL_META entries for all three — mirror driver_scan pattern.

app/api/greco/po-doc/route.ts (~64–73) wraps the GRECO_COMPANY_ID check in if (GRECO_COMPANY_ID). When NEXT_PUBLIC_GRECO_COMPANY_ID is empty (misconfigured deploy, staging), any authenticated user can enqueue bridge/ODBC po-doc relay jobs — ODBC cost and Entrée load without tenant pin.

Fix effort: Fail closed when GRECO_COMPANY_ID unset — return 503 instead of skipping gate.

lib/supabase/tool-reports.ts (~750–808) exports getTruckErrorsReportsRaw() to feed Return Diffs from truck_errors_reports JSONB. EntreeClient Return Diffs comment (~9899–9903) says BFC xlsx drag-drop replaced that path so operators can diff any file without uploading through /truck-errors first. Grep shows zero callers besides the definition — dead integration code that signals the truck-errors → Return Diffs pipeline was abandoned mid-merge.

Fix effort: Delete dead helper or rewire as optional Return Diffs BFC source — document chosen path in ArchitectureDiagram.

app/api/admin/godview/route.ts parseInt(searchParams.get('limit') || '100') has no max cap on users, activity, reports, email_logs, etc. One authenticated admin session can pull multi-megabyte cross-tenant payloads — separate from the tracked internal /api/anomalies limit gap.

Fix risk: Adding caps breaks export or load-all flows that depend on fetching entire tables.

Fix effort: Clamp limit to e.g. 500 in godview/route.ts parseInt.

getUsers, getProjects and sibling handlers in app/api/admin/godview/route.ts (~334–356, ~382) destructure count from .select(...) without { count: 'exact' }. total is always null/undefined — GodView pagination UI is broken across users, projects, chats and logs tabs. Separate from tracked unbounded limit cap — this is missing count plumbing even at normal limits.

Fix effort: Add { count: 'exact' } to godview list .select() calls.

app/api/health/route.ts checkAIService (~219) gates on process.env.GOOGLE_AI_API_KEY. Grep GOOGLE_API_KEY across app/api shows ai-summary, ai-analyze, routing/ai-build and agent/chat all read GOOGLE_API_KEY per .env.example. Production with only GOOGLE_API_KEY set: Gemini works, ?detailed=true health reports AI degraded — false alarm in ops runbooks.

Fix effort: One env var name fix in app/api/health/route.ts line 219.

app/components/HistoryPanel.tsx loads only when open && !loaded; loaded is set true on first fetch and never reset on close/re-open (comment says it refreshes but code does not). Operators who close the slide-over, generate a report, and reopen see stale data until full page refresh.

Fix effort: Reset loaded=false on panel close, or reload whenever open transitions false→true.

app/api/anomalies/route.ts:72 parses parseInt(searchParams.get('limit') || '50') with no Math.min cap and passes limit to getRecentAnomalies RPC. Sibling /api/v1/anomalies/route.ts:35–36 clamps days to 1–90 and limit to 200. app/api/jobs/route.ts:121 has same hole — limit flows into .range() on JSONB job payloads. Authenticated session holders can request ?limit=999999.

Fix risk: Capping limit may break internal dashboards or GodView scripts using ?limit=5000 today.

Fix effort: Copy clamp logic from v1 twins into anomalies + jobs routes (~5 lines each).

/api/anomalies GET parses ?limit= and ?days= with no cap and passes them straight to the get_recent_anomalies RPC, while /api/v1/anomalies clamps days to 1-90 and limit to 200. /api/jobs GET has the same hole — limit flows uncapped into .range(), payload JSON blobs and all. Anyone authenticated can request limit=999999.

Fix risk: Duplicate — anomalies/jobs large pulls may be intentional for exports.

Fix effort: Same limit caps.

Exports verifyPolicyPrecedence() and verifyEventCompleteness() (~62 lines) for agent policy precedence checks. Grep across the repo finds zero imports of policy-verification or either function — lib/agent/policy.ts and orchestrator resolve effective policy without these test helpers. Built for policy QA that was never wired into CI or runtime.

Fix effort: Delete lib/agent/policy-verification.ts or wire into agent policy tests if QA value remains.

Exports geocodeAddress(), batchGeocode(), getOSRMRoute() and unit helpers (~109 lines). app/tools/greco/routing/RoutingClient.tsx calls fetch('/api/routing/geocode') and inline OSRM instead. Grep finds zero imports of @/lib/routing/geocoder — duplicate geocoding logic maintained in a dead client module beside the live API route.

Fix effort: Delete lib/routing/geocoder.ts; RoutingClient already uses /api/routing/geocode.

The ~377-line module documents CRUD for API keys 'used by both API routes and settings UI,' but grep finds zero imports of lib/supabase/api-keys anywhere. Developer page uses fetch('/api/settings/api-keys') over HTTP instead. Entire typed client layer is dead weight beside the live route handlers.

Fix effort: Delete ~377-line module or wire developer page through it instead of raw fetch.

app/members/page.tsx line 80 sessionStorage.setItem('aiChatPrefill', question) before navigating to /chat, but grep across the entire app finds zero readers for that key. The button appears to wire a prefill flow that was never finished on the chat page.

Fix effort: Read aiChatPrefill in app/chat/page.tsx on mount (or remove the dead sessionStorage write).

app/api/monitoring/metrics/route.ts getUserMetrics (~259–268) selects from team_activity, but migrations only define team_activity_log (016_create_team_activity_log.sql). Query silently returns empty — activeToday always reads 0 in GodView/monitoring dashboards even when warehouse staff are active.

Fix effort: Change .from('team_activity') to team_activity_log with correct timestamp column in monitoring/metrics/route.ts.

lib/supabase/report-email-recipients.ts exports getRecipientUserIds() and getAllRecipientEmails() (~50 lines) with zero imports. Dashboard loads recipients via getEmailRecipients for the settings UI, and v1 analyze uses getAllRecipientsForCompany — but the two helper wrappers built to drive notification sends were never wired. Reinforces that per-tool email config is decorative on the UI path.

Fix effort: Delete getRecipientUserIds/getAllRecipientEmails or wire into notifyReportGenerated path.

lib/supabase/tool-reports.ts savePickerReport and getPickerReports console.log company_id, user_id, report data payloads and auth email. Visible on shared warehouse machines — debug logging that should have been stripped.

Fix effort: Delete console.log lines in lib/supabase/tool-reports.ts.

app/api/custom-tools/route.ts POST (~92–130) authenticates any company user and rate-limits, but never checks profile.role. UI may restrict the Build page to editors, but the API accepts up to 500KB code payloads from viewers. Enterprise SaaS should mirror UI role gates on mutating routes.

Fix effort: Reject POST when profile.role === 'viewer' — match Build page gate.

app/projects/page.tsx sendProjectChatMessage() (~61–100) catches errors with console.error only — no toast, inline error, or disabled-state feedback. Users believe a message sent when the Supabase insert failed. Missing session gate on mount is tracked separately.

Fix effort: Toast or inline error in sendProjectChatMessage catch — app/projects/page.tsx.

/api/public/item-alert-subscribe is an unauthenticated POST that inserts a subscription row and fires a confirmation email through Resend on every call — with no withRateLimit. Repeated { item, email } posts mean unbounded outbound email cost and DB writes from anyone on the internet.

Fix effort: Add withRateLimit to item-alert-subscribe route.

lib/greco/greco-tools.ts GRECO_TOOLS ends at /windowadmin — no entries for /inbound, /timer, /live/greco, /sales or /window (public booking). These routes are documented in ArchitectureDiagram and wired to greco session APIs, but founders cannot hide them via the /controls tool matrix and operators won't find them from the Tools tab without memorizing URLs (same discoverability class as tracked /port, /noe, /adrian gaps).

Fix effort: Add optional kiosk folder entries for /inbound, /timer, /live/greco, /sales, /window in greco-tools.

app/api/public-tools/info/route.ts returns full tool name + code with zero withRateLimit, while sibling /api/public-tools/data is rate-limited. Enables share_id enumeration and scraping of generated tool source at higher volume.

Fix effort: Add withRateLimit to public-tools/info like data route.

RELAY_HIDDEN_MODALS in EntreeClient.tsx (~446–447) includes 'dockVoo' alongside print, itemSearch and guide. Relay/tablet Shanetrée home (~9162, ~29421) filters modal tiles with !(relayMode && RELAY_HIDDEN_MODALS.has(key)) — dock-floor relay devices cannot open DockSheet from the Entree launcher even though /cindyvue and dashboard DockSheet links still work.

Fix effort: Remove dockVoo from RELAY_HIDDEN_MODALS or add explicit DockSheet shortcut on relay home.

lib/greco/greco-tools.ts GRECO_TOOLS: line 65 name 'Returns' → /truck-errors (truck error upload), line 67 'Returns+' → /returns (ledger), line 74 'Weekly Returns' → /returns-intel. greco_card_permissions keys by route — renames break denials. Labels mislead new users; safe fix is display-name only ('Truck Errors', 'Returns Ledger', 'Returns Intel').

Fix risk: greco_card_permissions keys by route path — renaming display labels is safe but changing routes breaks denials and saved permissions JSON.

Fix effort: Rename card labels in greco-tools.ts only — routes/permission keys stay.

lib/greco/greco-tools.ts GRECO_TOOLS maps three confusing pairs: line 65 name 'Returns' → route /truck-errors (truck error returns upload), line 67 'Returns+' → /returns (customer returns ledger), line 74 'Weekly Returns' → /returns-intel (weekly intel). greco_card_permissions and member_permissions.tool_access key by route string — renaming routes would break saved denials. Card labels could say 'Truck Errors', 'Returns Ledger', 'Returns Intel' without touching permission keys.

Fix risk: Same route-keyed permissions — '/returns' vs 'Returns+' label confusion is safer than route renames.

Fix effort: Same label rename.

loadRouteList ignores non-OK fetch responses (RoutingClient.tsx ~891–894). loadRoute returns false with no banner (~901–928). Export swallows saveOutputFile, logReportGeneration and notifyReportGenerated via .catch(() => {}) (~1439–1441). Operators can believe a route saved or exported when the API failed — empty load menu looks like 'no saved routes' not an error.

Fix effort: Surface res.ok failures and export .catch errors inline in RoutingClient.

app/api/routing/ai-build/route.ts calls gateway with timeoutMs: 90_000 (~445) but exports no export const maxDuration. Sibling app/api/port/ai-summary/route.ts:36 sets maxDuration = 90. Vercel platform default function timeout can kill mid-cluster generation → intermittent 504 on route planner AI builds.

Fix effort: export const maxDuration = 90 — one line, copy from port/ai-summary.

The route calls the gateway with timeoutMs: 90_000 yet exports no maxDuration — on Vercel the platform default can kill the function mid-generation, surfacing as flaky 504s. Sibling AI routes (port/ai-summary at 90, driver-chat/ai at 60) declare it; this one just forgot.

Fix effort: Same maxDuration export.

sentry.client.config.ts sets maskAllText: false and blockAllMedia: false with replaysSessionSampleRate 0.1 and replaysOnErrorSampleRate 1.0. Warehouse metrics, customer names and tool output can land readable in Sentry. Masking should be on by default with targeted unmasking.

Fix effort: Flip maskAllText: true in sentry.client.config.ts; unmask specific selectors if needed.

instrumentation.ts exports only register() (~8–16) importing sentry.server.config and sentry.edge.config — no export async function onRequestError. @sentry/nextjs v10 App Router docs require onRequestError to capture route-handler exceptions. Client path has app/global-error.tsx; grep onRequestError across repo returns zero matches. API route throws likely never become Sentry events unless manually captured.

Fix effort: Export onRequestError from instrumentation.ts per @sentry/nextjs v10 docs.

app/api/internal/shanetree-autopull/route.ts attributes snapshots and pull-log rows to SHANETREE_AUTOPULL_USER_ID, falling back to hardcoded f528c8d6-f7db-4d34-a656-680a3d3741de. On a fresh deploy without that env var, activity ledger, pull log and snapshots are stamped with one fixed user regardless of who operates the bridge.

Fix effort: Require SHANETREE_AUTOPULL_USER_ID env var (fail if missing) instead of hardcoded fallback UUID.

app/shrink-meeting/page.tsx logs + notifyReportGenerated (~370) but never upsertDailyStat. app/counting/CountingClient.tsx logs via logTeamActivity (~531–542) only — no upsertDailyStat, logReportGeneration, or notifyReportGenerated. Meat-count ledger entries appear in /history but Daily Stats grid and greco-digest stay blind.

Fix effort: Add upsertDailyStat + TOOL_META keys for shrink_meeting and counting on save.

app/entree/StockVooPanel.tsx (~733) sets disabled={loading || portMode} on Refresh. /port relay tablet users cannot re-pull live inventory ODBC; UI does not explain they are viewing a frozen snapshot — operators may assume stock counts are current.

Fix effort: Show 'snapshot only on /port' banner when portMode disables Refresh — StockVooPanel.tsx.

supabase/migrations/README.md 'Migration Files' section ends at 011_create_truck_errors_reports_table.sql with hand-run SQL Editor instructions. git ls-files counts 150 migration SQL files including 136_create_account_geocodes.sql. Fresh DBA following README applies the wrong subset. Professional fix: auto-generate migration index from filenames or delete README body and point to Supabase CLI only.

Fix effort: Rewrite README to point at Supabase CLI only or auto-generate file list from migrations/.

app/team-chat/page.tsx (~162–172) calls createChatRoom('', [dmUserId], 'direct') when no existing DM exists. On !result.success there is no toast, error state, or fallback — user stays on room list with no explanation. Broken DM links from mentions or dashboard look like a no-op.

Fix effort: Show toast/setError when createChatRoom returns !success in team-chat/page.tsx.

handleCreateChat in app/team-chat/page.tsx (~262–283): createChatRoom failure has no else branch — no toast, no error state. Modal stays open with no feedback when room creation fails (RLS denial, duplicate direct message, network blip).

Fix effort: Show error toast in handleCreateChat else branch when result.success is false.

notifyChatMessage() exists in lib/notifications/trigger.ts but has zero callers outside its definition. team-chat handleSendMessage only inserts via sendChatRoomMessage — users who enable chat_notifications in account settings never get emails from team-chat activity.

Fix effort: Call notifyChatMessage() after successful sendChatRoomMessage in team-chat/page.tsx.

/api/health's AI probe checks GOOGLE_AI_API_KEY, but every actual AI route reads GOOGLE_API_KEY (which is what .env.example documents). Production can have Gemini fully working while health reports AI as degraded — false alarms baked into the runbook.

Fix effort: Same env var rename.

Initial week/day hydration in app/thruput/page.tsx (~171–207) catches errors with console.error only — no setError banner. A missing thruput_days table or RLS denial looks identical to 'no data yet this week,' so night-shift leads may rebuild staffing from scratch while the real rows failed to load.

Fix effort: setError banner in thruput/page.tsx catch blocks when getThruputWeeks/Days fails.

DEFAULT_ACTIVE in app/thruput/page.tsx (~114–129) seeds early500, loaders, runners, forklift areas, management and sick/off lists with real Greco staff names (e.g. 'Chilchoa, Moises', 'Acabal, Ramon', 'Cisneros, Rodolfo'). New weeks/days inherit that roster until manually cleared — a privacy and onboarding hazard if the page is ever shared outside the warehouse or reused for demos.

Fix effort: Replace DEFAULT_ACTIVE with empty placeholders or load from last saved week.

app/transfers/TransfersClient.tsx (~128, 136) and app/cyclecount/CycleCountClient.tsx (~128–129) call upsertDailyStat(...).catch(() => {}) and notifyReportGenerated(...).catch(() => {}) with no UI feedback. Driver Scan silent-save pattern is tracked — Transfers/Cycle Count have the same analytics divergence risk.

Fix effort: Toast on catch instead of empty .catch(() => {}) — match driver-scan fix.

app/api/v1/tools/generate/route.ts (~103) hardcodes is_public:true on every API-generated tool, minting a public /t/{share_id} surface regardless of builder intent. Pairs with tracked 'no in-app public link' discoverability gap — API path auto-publishes.

Fix effort: Accept is_public param defaulting false; document public share opt-in in OpenAPI.

ALLOWED_PATH_PREFIXES in app/api/v1/batch/route.ts (~38–51) includes /api/v1/agent but not /api/v1/ai/chat or /api/v1/ai/chat/stream despite both being live in openapi.json. Batch clients get 400 for AI chat operations. Calendar batch gap is tracked separately.

Fix effort: Add /api/v1/ai/chat and /api/v1/ai/chat/stream to ALLOWED_PATH_PREFIXES.

app/api/v1/batch/route.ts ALLOWED_PATH_PREFIXES (~38–51) lists /api/v1/reports, /tools, /schedules, etc. but omits /api/v1/calendar. First-class routes /api/v1/calendar/events and /api/v1/calendar/available-slots accept API keys independently. Batch POST returns 400 'path not allowed' for { method:'GET', path:'/api/v1/calendar/events' } — integrators must special-case calendar outside batch.

Fix effort: Add '/api/v1/calendar' to ALLOWED_PATH_PREFIXES in batch/route.ts.

app/api/v1/export/route.ts (~236) tells clients to 'Poll GET /api/v1/export with the job ID'. Actual status endpoint is GET /api/v1/export/:id (app/api/v1/export/[id]/route.ts). API integrators following the message get 400/405 loops until they discover the correct path.

Fix effort: Fix message to GET /api/v1/export/{job_id} in export/route.ts.

Sibling app/api/v1/reports/route.ts rejects bodies >5MB via content-length (~43–52). v1/reports/analyze parses JSON with no size guard — only truncates data to 15k chars for the model (~137–141) after the full body is already in memory. Large API payloads can OOM serverless functions.

Fix effort: Mirror v1 /reports content-length guard (~5MB) before JSON parse.

app/api/v1/tools/route.ts handlePost (~88–96) accepts body.code string with no .length cap. Internal app/api/custom-tools/route.ts (~112–115) rejects code > 500KB. API-key consumers can INSERT multi-megabyte HTML into custom_tools.code — Postgres row bloat, slow list queries, potential Vercel body-size failures at edge.

Fix effort: Apply same 500KB code cap as session custom-tools route.

app/api/v1/schedules/route.ts defines isValidCron() (~23–26, 5-field check) and calls it in handlePost (~130). app/api/v1/schedules/[id]/route.ts handlePut (~106) assigns body.cron to cron_expression with zero validation — empty string, 'not-a-cron', or 100-field strings persist. job_schedules.cron_expression is plain text with no DB CHECK. Scheduler computing next_run_at from garbage crons fails silently for that row.

Fix effort: Share isValidCron() in PUT handler; add DB CHECK or cron parser library for semantic validation.

lib/greco/greco-tools.ts line 83 routes 'Will-Call Window' to /windowadmin. Customer/driver self-service booking lives at /window (WindowClient.tsx). Operators picking 'Window' from the tools grid land on the authenticated review UI; public /window is only linked from a small header on windowadmin. Misleading card for floor staff hunting the booking kiosk.

Fix risk: Changing card href affects trained operators; /windowadmin vs /window is a product decision tied to permissions.

Fix effort: Point greco-tools card at /window or add second 'Window (public)' card.

app/api/admin/verify/route.ts accepts public POST { password } and returns { valid: true|false } against ADMIN_PASSWORD. Only generic per-IP rate limiting — no session requirement, lockout, or CAPTCHA. Credential stuffing against a shared admin password.

Fix effort: Require authenticated session before comparing password, or remove endpoint and use server-only admin gate.

app/api/agent/chat/route.ts (~168–188) inserts into ai_chat_messages using client-supplied sessionId after auth, without verifying the session exists or belongs to userInfo.companyId / userInfo.userId. Known or guessed UUIDs allow cross-session message injection and updated_at bumps on foreign sessions.

Fix effort: Verify session belongs to userId + companyId before insert — one guard in agent/chat/route.ts.

app/api/email/send/route.ts validTemplates (~60–64) lists 10 names; lib/email/service.ts EmailTemplate (~13–30) also defines ai_summary, anomaly_alert, agent_notification, agent_digest, dockvoo_checkin, item_scheduled, item_checked_in, item_received. Internal or agent callers using those template names get 400 Invalid template even though NotificationService can render them.

Fix effort: Expand validTemplates in email/send/route.ts to match EmailTemplate union in lib/email/service.ts.

app/chat/page.tsx loadData() calls getChatSessions(50) unconditionally whether or not a session exists. No /login redirect anywhere in the file. Logged-out visitors get the full chat shell with an empty list and a Supabase query on mount.

Fix effort: Gate loadData on session + router.push('/login') — mirrors other pages.

app/confirmation/page.tsx always renders 'Your email has been verified and your account is ready' with a dashboard link. No getSession() check, no Supabase auth listener — anyone who visits the URL sees a success screen whether or not they just confirmed email.

Fix effort: Check for fresh recovery session or redirect; avoid showing success to random visitors.

app/inbox/InboxClient.tsx loadThreads and loadMessages destructure only { data } and never inspect error. A failed query (RLS denial, network blip, stale token) renders as an empty thread list or empty conversation with no error banner — the page's error state is only used for send/AI failures.

Fix effort: Check error in loadThreads/loadMessages and set error state — InboxClient.tsx.

Print-once guard in will-call-print-request/route.ts (~221–239) applies only when requester='sales'. /noe posts requester:'noe' (EntreeClient.tsx ~26503–26507) with only 20s dedupe. UI clears 'Queued' after 5s (~26520–26530) with no GET ?id= outcome polling — unlike /sales which polls until done/failed (~939–982). Operators can re-queue the same invoice indefinitely from /noe.

Fix effort: Extend print-once semantics to noe or track per-invno consumption like sales.

requestNoeLsPrint in EntreeClient.tsx (~26497–26530) sets 'Queued' then clears after 5s — no status poll. Bridge-side noe-print watcher (~27227+) fulfills rows but /noe UI never surfaces done/failed like /sales does. Comment at ~27238 claims /noe can show final status; client code does not implement it.

Fix risk: Adding poll changes kiosk CPU/network; removing watcher breaks silent print failures.

Fix effort: Poll will-call-print-request ?id= in requestNoeLsPrint like SalesClient requestPrint.

app/picture/page.tsx (~127) labels the page PUBLIC • NO LOGIN. Documents ODBC/bridge data flow with PDF export via jspdf + html2canvas (~40–109). No auth, rate limit, or tenant gate — internal infra diagram exposed to anyone with the URL (linked from /port relay docs).

Fix effort: Require session or move to /docs; rate-limit PDF export — product decision on public relay collateral.

/port wraps EntreeClient in portMode for ODBC-less devices. Grep for nav links to /port finds only picture/page.tsx, docs and an internal EntreeClient reference — not in GRECO_TOOLS, dashboard or greco-tools cards. Documented in /docs but absent from operational navigation; useful fallback with no way to find it.

Fix effort: Add GRECO_TOOLS card or dashboard Workspace link labeled 'Port mode (no ODBC)'.

app/produce/page.tsx (~800 lines) implements produce-item browsing via ODBC relay, but app/entree/ProducePanel.tsx line 6 says it was 'Ported from the standalone /produce page.' Grep finds no href/router links to /produce from live app pages — only the Entree panel and API paths remain. Entire route is a duplicate entry point with no navigation.

Fix risk: Deduping parallel implementations must update every copy or behavior drifts again.

Fix effort: Delete app/produce/page.tsx and redirect /produce → /entree with produce panel open, or add nav link if standalone is intentional.

app/projects/page.tsx loadProjectMessages (~48–58) runs once when a project expands — no postgres_changes subscription. Admin replies via GodView or dashboard won't appear until re-expand/refresh. Send failures are console.error only (~96–97).

Fix risk: Realtime filter changes alter what live updates appear — easy to hide needed events.

Fix effort: Subscribe to project_messages postgres_changes when project expands.

SalesClient.tsx (~1130–1148): when filtered rows are empty and the query looks like an invno, 600ms debounce calls runInvoiceLookup() which POSTs /api/public/invoice-status (~1017–1022) — direct ODBC or relay enqueue. Combined with unauthenticated, un-rate-limited endpoint, typo-sweeping on a shared kiosk can stack bridge jobs.

Fix effort: Require explicit Search button or throttle invoice-status POSTs per kiosk session.

app/scan/page.tsx never checks session or redirects to /login — only optionally loads getUserCompanyId for Greco tool filtering. Unauthenticated visitors can upload spreadsheets, run detection and router.push into warehouse tool routes (which may gate later).

Fix effort: Redirect unauthenticated users to /login or require session before file upload.

app/scan/page.tsx stores scannerFile in sessionStorage and redirects, but /reconciliation, /loader and /returns-intel never read that key (grep returns no matches). Nine other tools do consume it — users routed through scan to those three arrive with nothing loaded.

Fix risk: Wiring reconciliation/loader/returns-intel to scannerFile changes upload path for users who worked around missing key.

Fix effort: Add scannerFile reader to reconciliation, loader, returns-intel pages (copy from forklift pattern) OR remove those three from scan routing table.

app/scan/page.tsx (~294–306) stores the entire file as a base64 data URL in sessionStorage scannerFile with no size check or try/catch around setItem. Large .xlsx files commonly exceed ~5MB quota → silent redirect with nothing loaded. Tracked mis-wire to three tools is a separate issue.

Fix risk: Moving to IndexedDB or Storage changes large-file scan flow timing.

Fix effort: Size-check file before base64; use IndexedDB or server staging for large uploads.

Route comment says 'Greco staff review' but access is GrecoOnlyGuard only (app/windowadmin/page.tsx). Unlike /controls founder/admin gate (ControlsClient.tsx), any Greco editor/viewer with a bookmark opens the appointment review console. Pairs with RLS allowing any member to accept/reject (#1 above).

Fix effort: Wrap /windowadmin in founder/admin role check like ControlsClient.

Account settings expose chat_notifications and mention_notifications toggles (app/account/page.tsx) persisted to user_notification_preferences. lib/email/service.ts maps them to templates, but notifyChatMessage() and notifyMention() in lib/notifications/trigger.ts have zero callers — team-chat never triggers either. Users enable 'email me on mentions' and nothing ever sends. report_notifications still works via notifyReportGenerated; chat/mention prefs are decorative (~4 exported notify helpers, ~45 lines, never called).

Fix risk: Wiring latent toggles suddenly enables or blocks behavior users assumed was active.

Fix effort: Call notifyChatMessage/notifyMention after send/mention, or hide toggles until wired.

account/page.tsx exposes security_alerts in NOTIFICATION_OPTIONS (~43–46) with copy 'You will always receive critical security notifications' (~1199–1200). grep sendSecurityAlert finds only the definition in lib/email/service.ts (~306) — zero callers. Toggle persists to user_notification_preferences but nothing ever sends security_alert emails.

Fix risk: Wiring latent toggles suddenly enables or blocks behavior users assumed was active.

Fix effort: Wire sendSecurityAlert on password change/login anomalies, or hide toggle.

supabase/migrations/136_create_account_geocodes.sql:20 defines company_id uuid not null with no REFERENCES companies(id) — header comment promises multi-tenant scoping but FK omitted. RLS policies (~37–56) filter by profiles.company_id; orphaned UUIDs from bad imports pass INSERT and pollute Window Map geocode cache keys (company_id, custno) unique index.

Fix risk: Adding FK fails migration if orphan rows exist — must clean Window Map cache first.

Fix effort: New migration: ADD CONSTRAINT REFERENCES companies(id) — verify no orphan rows first.

lib/agent/policy.ts isWithinPolicyWindow() (~167–177) uses getUTCDay(), getUTCHours() and getUTCMinutes(). Policy carries scheduling.timezone (~114) and dry-run returns it (app/api/agent/policy/schedules/dry-run/route.ts ~40), but window checks ignore the configured timezone. Autonomy cron + policy dry-run can disagree with US warehouse hours operators think they configured.

Fix risk: Date boundary changes reorder stats, leaderboards, and filters keyed on existing date columns.

Fix effort: Convert at to policy.scheduling.timezone before day/hour/minute check in isWithinPolicyWindow.

lib/agent/tools.ts queryReports() passes args.limit straight to .limit(limit) with no clamp (executeTool default 50 only when arg omitted). A single agent tool call with limit: 50000 pulls full JSONB report rows for a tenant via service-role client — parallel to tracked internal API limit gaps.

Fix effort: Math.min(args.limit ?? 50, 200) in executeTool before queryReports and sibling query tools.

lib/email/service.ts (~491–493) uses ${data.actionUrl} in an anchor with no same-origin or https allowlist. Agent-supplied or forged actionUrl values can become open redirects or phishing links inside FileDisplay-branded notification emails.

Fix effort: Allowlist actionUrl to same-origin paths or https://filedisplay.com/* before rendering button.

app/api/cron/agent-autonomy/route.ts (~33–37) selects agent_settings rows with auto_summarize or auto_email_digest, then .limit(100) — no .range() pagination, no overflow counter in JSON response. vercel.json schedules */10; companies alphabetically beyond row 100 silently never enqueue digest agent_tasks. GodView tenant list can exceed 100 without any cron metric surfacing the skip.

Fix effort: Paginate settings query or raise limit with overflow logging in JSON response.

GET /api/greco/analytics-log applies date_from/date_to as `${date}T00:00:00.000Z` and `T23:59:59.999Z` (~35–39). Eastern evening report saves (local Jul 9 ~8pm) store created_at as Jul 10 UTC and fall outside a Jul 9 filter on the Daily Stats Analytics Log — separate from report_date stamping but same operator confusion on date pickers.

Fix risk: Date boundary changes reorder stats, leaderboards, and filters keyed on existing date columns.

Fix effort: Filter on report_date or warehouse-local day bounds instead of created_at Z midnight.

lib/cache/service.ts apiKeyCache.invalidateCompany(companyId) (~426–428) accepts companyId but calls cacheDeletePattern('fd:api_key:*') — wipes every tenant's cached API keys on one company's key rotation. Comment at ~402 admits 'can't easily find all users in a company'. invalidateApiKeyCache(keyHash) correctly deletes one hash (~510–511). Cross-tenant cache flush on single-key revoke is a multi-tenancy footgun.

Fix risk: Duplicate — global pattern delete affects every API consumer simultaneously.

Fix effort: Scope cacheDeletePattern to companyId in lib/cache/service.ts; add company check on invalidate_user.

The tool-generation flows in app/build/page.tsx stage fake pipeline progress with four chained setTimeouts, cleared only on the success path — the catch blocks never clear them, and neither does unmount. A failed generation (or navigating away mid-request) leaves orphan timers calling setCurrentStep on a dead flow. Same pattern in generateFromPrompt and refineCode.

Fix effort: Same as build/unmount timer leak — clear timeout refs in catch + useEffect cleanup.

app/build/page.tsx chains four setTimeout calls for fake pipeline progress in generateFromFile, generateFromPrompt and refineCode. Timeouts cleared only on success path; catch blocks don't clear them and there's no unmount cleanup. Failed generation or navigating away leaves orphan timers calling setCurrentStep on dead state.

Fix effort: Store timeout IDs in ref, clear in catch + useEffect cleanup — ~3 functions in build/page.tsx.

app/calendar/page.tsx never redirects unauthenticated users. It loads events, renders the full calendar UI, and only skips setting currentUserId when getUser() returns null. Logged-out visitors see an empty calendar shell and can open the event form — createCalendarEvent will fail at RLS, but the page shouldn't render at all.

Fix risk: Central auth changes affect every protected route and public kiosk exception list.

Fix effort: Add same auth redirect pattern as account/page.tsx at top of calendar load effect.

getCalendarEvents(..., calendarTab) filters personal vs company in lib/supabase/calendar.ts (~93–108). subscribeToCalendarEvents in calendar/page.tsx (~542–546) inserts every calendar_events row for the company with no calendarTab, date-range or visibility filter. On Personal tab, colleagues' company events appear live incorrectly.

Fix risk: Filtering subscription may hide legitimate cross-tab updates users currently see (and complain about).

Fix effort: Filter realtime inserts/updates in calendar/page.tsx by calendarTab visibility rules.

app/calendar/page.tsx EventDetail (~421–427) renders edit/delete for all expanded events with no created_by === currentUserId check. RLS allows DELETE only for creator (088_create_calendar_events.sql ~70–76); handleDelete (~571–574) calls deleteCalendarEvent and reloads without surfacing RLS failure — operators think they deleted a coworker's event when nothing changed.

Fix effort: Hide edit/delete unless event.created_by === user.id; surface RLS error toast on failed delete.

app/calendar/page.tsx sub-nav (~627–680) is flex justify-between with calendar tabs, view-mode toggle and month prev/next in one row with no flex-wrap. On narrow viewports the month navigation and view controls collide with Personal/Company tabs — horizontal overflow or clipped controls.

Fix effort: flex-wrap sub-nav or collapse month nav into a compact dropdown below md breakpoint.

lib/supabase/calendar.ts getCalendarEvents returns [] on error. handleSave catches with console.error only; handleDelete has no try/catch. Network blip during save/delete looks like success; failed load looks like an empty calendar.

Fix risk: Surfacing errors changes empty-state UX — operators may think calendar is broken when network blips.

Fix effort: Add error state banner + surface calendar.ts errors instead of returning [].

supabase/migrations/081_create_calls.sql creates a calls table with realtime publication. Grep for .from('calls') across the entire repo returns zero matches. calendar_events.call_type (migration 088) is similarly unused in app code. ~45 lines of schema + RLS for a video-call feature that was scaffolded and abandoned.

Fix effort: Drop calls table + call_type column in a migration, or scope a minimal WebRTC spike before keeping schema.

app/chat/page.tsx Greco-only viewMode === 'vibe' renders <iframe src='/vibe' title='Build — Tool Builder'> (~1008–1014) while the tab label says Build. /vibe is the web studio; /build is the custom-tool file/prompt builder — the iframe title and tab name imply the wrong product surface.

Fix effort: Point iframe at /build or rename tab to Vibe; fix title attribute to match actual src.

supabase/migrations/107_create_ide_context_index_and_client_events.sql creates client_events with INSERT RLS. Writer is app/api/telemetry/client-event/route.ts only. No cron, TTL index, partition strategy or cleanup migration — table grows unbounded as IDE/desktop extension telemetry accumulates.

Fix effort: Cron deleting rows older than 90d or partition by month — migration + vercel.json cron entry.

lib/cache/service.ts defines companyCache.get/.set (~351–365) and statsCache.get/.set (~458–467). Grep companyCache|statsCache across the repo finds only invalidateCompanyCache() calling .invalidate / .invalidateAll (~500–502). No .get or .set callers anywhere — ~120 lines of cache objects that never store or read data; invalidation runs against empty caches.

Fix effort: Wire .get/.set at read sites or delete cache objects and simplify invalidateCompanyCache.

CONTROLLABLE_TABS (~64–74) still lists members, chat, history and stats as dashboard tabs and feeds getDefaultDashboardTabs() for permission presets. Any future wiring of dashboard_tabs would gate the wrong tab IDs — same IA drift as the Account/Controls visibility toggles.

Fix effort: Same realignment as tab visibility — single source of truth in lib/dashboard/tabs.ts.

MemberPermissionsSection saves tool_access, tool_features and three edit flags (~79–85) but never renders or writes dashboard_tabs even though updateMemberPermissions supports it. Founders cannot configure per-member tab ACL in the admin UI that was built for it — paired with the dashboard never reading the field.

Fix effort: Add dashboard_tabs matrix to MemberPermissionsSection using updated CONTROLLABLE_TABS.

app/daily-stats/DailyStatsClient.tsx fmtDate() uses d.toISOString().split('T')[0] (~84–85) for selectedDate, week navigation (~731–733) and Today (~866). After ~7–8pm Eastern, 'today' becomes tomorrow UTC — parallel to tracked Shanetrée/DockSheet UTC issues but specific to /daily-stats operator date picking.

Fix risk: Aligning to local TZ must match report_date columns in greco_daily_stats or grid shows empty days.

Fix effort: Use America/New_York (or company timezone setting) for fmtDate — same fix class as Greco UTC dates.

Email Settings modal (~2837+) and Per-Report Settings modal (~3154+) are fixed inset-0 overlays with no role='dialog', aria-modal, aria-labelledby, Escape-to-close or focus trap. Same gap class as team-chat/developer modals already tracked — but these two high-traffic dashboard modals were missed.

Fix effort: Add role=dialog, aria-modal, Escape and focus trap to emailSettingsModal and reportSettingsModal overlays.

dashboard/page.tsx calls loadMyMentions() / loadUnreadMentionCount() once on mount (~436–437, ~914–932). No postgres_changes on team_mentions (contrast team-chat subscribeToChatRoomMessages and calendar subscriptions). New @mentions require manual refresh or navigating away — badge can stay stale on a long-lived dashboard session.

Fix risk: Realtime filter changes alter what live updates appear — easy to hide needed events.

Fix effort: postgres_changes on team_mentions filtered by mentioned_user_id; refresh badge on insert.

subscribeToAIConversationComments() exists in lib/supabase/ai-conversations.ts but is never imported. Dashboard subscribes to new conversations via subscribeToAIConversations only — new comments on existing conversations won't appear until manual refresh or the 30s polling interval.

Fix effort: Import and wire subscribeToAIConversationComments alongside existing conversation subscription.

app/dashboard/page.tsx still calls alert() for AI-filter save failures, external-email add/remove, file download errors, AI summary failures and quote submission accept/reject (~619–1409). Blocking native dialogs interrupt warehouse workflows, can't be styled or translated consistently, and feel out of place beside the polished glass UI elsewhere.

Fix effort: Replace ~10 alert() calls with inline toast/banner state — reuse existing dashboard error UI patterns.

app/developer/page.tsx loadApiKeys and loadWebhooks catch errors with console.error only. UI renders 'No API Keys' / 'No Webhooks' with no error banner — identical to a real empty integration setup. Tier banner failures are also swallowed.

Fix effort: Surface fetch errors inline on developer/page.tsx instead of empty-state copy.

app/developer/page.tsx modals at ~1039+ (showCreateKeyModal, webhook create/details) use fixed inset-0 bg-black/50 overlays with inner white panel — backdrop click and X close only. grep role='dialog' / aria-modal / onKeyDown Escape in developer/page.tsx returns zero. Same mouse-only pattern as calendar EventFormModal and members overlay.

Fix effort: Same dialog pattern on three developer/page.tsx modals.

app/developer/page.tsx (~358–369) sends newWebhookUrl.trim() to POST /api/settings/webhooks with no https:// requirement or SSRF blocklist. javascript: or internal host URLs can be stored as webhook targets — delivery worker may fail or hit unexpected endpoints when triggered.

Fix effort: Require https:// and block private IP ranges on POST /api/settings/webhooks + developer UI validation.

Fields exist in lib/agent/permissions.ts (~29–30, 114–115) and lib/agent/settings-shared.ts, and appear in OpenAPI agent settings schema. AgentSettingsPanel has no recipient picker or day-of-week control; cron/worker ignore both. OpenAPI types digest_day_of_week as string; code uses number — schema drift on top of dead fields.

Fix effort: Add recipient/day UI in AgentSettingsPanel + read fields in cron/worker; fix OpenAPI type to number.

/api/dockvoo/notify loops the company's notification preferences and sends an email per subscriber (plus per-PO bridge relay calls for time_in/docked events) on every POST — authenticated, but with no rate limit. Any company member can hammer colleagues' inboxes and the bridge with repeated check-in events.

Fix effort: Per-user rate limit on /api/dockvoo/notify.

CindyVueClient.tsx session bootstrap (~1277–1332) sets const today = new Date().toISOString().slice(0, 10) when picking the active workspace tab. Combined with global LS_DATE_KEY ('cindyVueLastDate' in lib/tools/greco/lib/constants.ts), a receiver opening DockSheet near midnight UTC boundary can land on the wrong session_date relative to the warehouse clock.

Fix risk: Date boundary changes reorder stats, leaderboards, and filters keyed on existing date columns.

Fix effort: Use warehouse-local date helper in CindyVueClient bootstrap; align with session_date convention.

app/live/greco/page.tsx picks today via new Date().toISOString().slice(0, 10) (UTC). Sibling /timer uses localTodayStr() (browser local). After ~7–8pm Eastern, Live can open yesterday's session while Timer opens today's — inconsistent kiosk behavior.

Fix risk: Date boundary changes reorder stats, leaderboards, and filters keyed on existing date columns.

Fix effort: Reuse localTodayStr() from timer or America/New_York helper for initial selectedDate.

app/live/greco/page.tsx loadSession() and the dates bootstrap use if (!res.ok) return and empty catch blocks. Network/500 failures render 'No data for this date' — indistinguishable from a genuinely empty dock day. No error banner or retry beyond manual refresh.

Fix risk: DockSheet session stack — autosave, grid, and public kiosks depend on current save semantics.

Fix effort: Add error state + retry banner in app/live/greco/page.tsx when fetch fails.

app/api/dockvoo/notif-prefs/route.ts GET returns companyLog with every watched PO plus user_id, user_email and user_name for all enabled company members. Any authenticated tenant user can enumerate colleagues' auth emails via admin.auth.admin.getUserById in the loop at lines 82–88.

Fix effort: Return only caller's prefs on GET; move companyLog to admin-only endpoint or strip emails.

Beyond tracked kiosk theme keys: CindyVue persists cindyVueLastDate (LS_DATE_KEY), per-day session blobs and workspace tab lists in localStorage with no userId suffix. Shared receiving PCs inherit the previous receiver's active date and offline backup payload — can restore the wrong day's grid after shift change.

Fix risk: Receiver desk PCs share layout/date prefs — namespacing changes which session date opens by default.

Fix effort: Prefix LS_DATE_KEY and per-day keys with userId or shift token on shared PCs.

app/documents/page.tsx Create Document overlay (~1162–1286) is a fixed inset-0 div with backdrop click and X to close — no role='dialog', aria-modal, Escape handler or focus trap. Fourth high-traffic modal in the same accessibility gap class (after calendar, members, team-chat, developer).

Fix effort: Add role=dialog, aria-modal, Escape and focus trap to showCreateModal overlay.

app/documents/page.tsx schedules typing-indicator, content-diff and history snapshots through timeout refs with no unmount cleanup. Leaving mid-edit can fire broadcasts and setState on an unmounted component. Unsaved-changes confirm() guards in-app nav only — no beforeunload for tab close/refresh.

Fix effort: useEffect cleanup clearing three timeout refs + optional beforeunload — documents/page.tsx only.

app/documents/page.tsx schedules typing-indicator, content-diff and history snapshots through three timeout refs with no unmount cleanup — leaving the page mid-edit can fire broadcasts and setState on an unmounted component. Separately, the unsaved-changes confirm() only guards in-app doc switching and back-to-list; there's no beforeunload handler, so a tab close or refresh silently discards long-form edits.

Fix effort: Same cleanup + beforeunload.

app/driver-scan/DriverScanClient.tsx (~67) injects https://cdnjs.cloudflare.com/ajax/libs/exceljs/4.3.0/exceljs.min.js with no integrity attribute. Parallel supply-chain risk to tracked Supabase CDN pin in app/layout.tsx — dock-floor machines parse driver scan xlsx through a third-party script tag.

Fix risk: Pinning/SRI is safe; swapping loader breaks offline dock tablet if CDN blocked.

Fix effort: Bundle exceljs via npm import or add SRI + version pin — match Entree dynamic import pattern.

supabase/migrations/129_create_driver_chat.sql lines 132–135: UPDATE policy checks only company_id membership, not role. /inbox AI toggles write driver_chat_settings.ai_enabled_all and response_mode — UI implies an operational control, but schema lets any member including viewers change global driver-chat AI behavior via Supabase client or inbox UI.

Fix effort: Tighten UPDATE policy to manager+ roles; mirror in API route checks.

requireGrecoUser() in lib/driver-chat/db.ts (~86–104) only checks profile.company_id === GRECO_COMPANY_ID — any Greco member including viewers can hit /api/driver-chat/ai, /api/driver-chat/settings and manual ai-respond. Combined with driver_chat_settings UPDATE RLS allowing any company member, floor viewers can flip global AI auto-reply without founder/admin role.

Fix effort: Restrict /api/driver-chat/settings and ai-respond to founder/admin/manager roles.

postMessage() in lib/driver-chat/db.ts sets greco_unread / driver_unread to (staleThreadObject.unread || 0) + 1 — a read-modify-write from a thread object fetched earlier in the request. Two messages arriving close together on one thread can produce a count of 1 instead of 2. Should be an atomic UPDATE … SET greco_unread = greco_unread + 1 (or an RPC).

Fix effort: Same atomic increment.

lib/driver-chat/db.ts postMessage() (~186–215) inserts message then sets greco_unread = (thread.greco_unread || 0) + 1 using thread object passed from caller's earlier SELECT. Concurrent messages on one thread (two drivers, AI + human) race read-modify-write — count can stay at 1 when 2 arrived. Fix: atomic UPDATE driver_chat_threads SET greco_unread = greco_unread + 1.

Fix effort: Atomic UPDATE SET greco_unread = greco_unread + 1 in lib/driver-chat/db.ts or small RPC.

app/drivers/DriversClient.tsx, app/transfers/TransfersClient.tsx and app/cyclecount/CycleCountClient.tsx have no getToolPagePermissions import. Viewers get full generate/export. Geronimo permission gap is tracked — these three warehouse tools share the same inconsistency with the /controls permission matrix.

Fix effort: Wire getToolPagePermissions gate on export/generate buttons — copy negative-slots pattern per client.

app/components/ holds 24+ live UI modules (FancyLoader, GodView, GrecoOnlyGuard, etc.) imported across the app. Root components/ holds only ShanetreeWhitepaperSections.tsx, ShanetreeWhitepaperGuideSections.tsx and components/docs/ShanetreeDocsSection.tsx — imported via @/components/ from EntreeClient and app/docs. tsconfig paths map @/* to ./* so both work, but the split confuses every new contributor ('where do I add a component?'). Consolidate under app/components/ or src/components/ with one rule.

Fix effort: Move three root components/ files into app/components/docs/; update @/ imports.

DockSheet, Guide and Shanetrée each exist as an overview card AND a tab-bar link; AI and Docs are Workspace-folder cards and tab-bar links. The non-Greco overview no longer duplicates AI/Docs/Reports (they live in the Workspace folder now), and the remaining tab-bar links are marked with ↗ as shortcuts. The card is the canonical home; the tab strip is a quick-jump row.

Fix risk: Deduping parallel implementations must update every copy or behavior drifts again.

Fix effort: IA cleanup — mostly done; remaining overview card vs tab-bar shortcut duplication.

Only app caller of /api/embeddings is forklift/page.tsx (~699–710): fetch with .catch(() => {}) and no response.ok check. Missing OpenAI key or route errors mean vector indexing fails invisibly — semantic search/RAG for forklift reports never updates with no operator feedback.

Fix effort: Check response.ok in forklift fetch; optional toast when embedding index fails.

lib/supabase/team-activity.ts exports getTeamActivityByTool, getTeamActivityByUser, getAnalyticsLog and toggleActivityExcluded (~120 lines) with zero imports. AnalyticsLogPanel bypasses getAnalyticsLog and fetches /api/greco/analytics-log directly (app/components/AnalyticsLogPanel.tsx:104). Built for admin drill-downs that were never surfaced in UI.

Fix effort: Delete helpers or expose in Controls/History admin UI if still wanted.

app/api/custom-tools/generate-from-file/route.ts (~281) parses body with no content-length cap — unlike generate/route.ts (~386–395) which caps at 1MB. Build sends the full client profile (app/build/page.tsx ~643) enabling oversized payloads and memory pressure server-side.

Fix risk: Adding caps breaks export or load-all flows that depend on fetching entire tables.

Fix effort: Cap request body size like generate route; reject oversized profiles early.

app/api/routing/geocode/route.ts GET (~6–34) accepts any ?q= string, forwards to nominatim.openstreetmap.org with FileDisplay User-Agent, no auth, no withRateLimit. Used by app/tools/greco/routing/RoutingClient.tsx. Abusable as free geocoding relay under FileDisplay IP; Nominatim ToS requires rate limiting — this route has none.

Fix risk: Auth or 1 req/sec limit breaks Window Map modal batch geocode on account roster open — Nominatim throttle already painful.

Fix effort: Same rate limit + auth on /api/routing/geocode.

app/api/routing/geocode/route.ts GET (~6–34): no withRateLimit, no getUser()/session check — any caller passes ?q=, server forwards to nominatim.openstreetmap.org with FileDisplay User-Agent. RoutingClient.tsx and account-geocodes Window map depend on it. Abusable as free geocoding relay under FileDisplay egress IP; Nominatim usage policy expects ≤1 req/sec per app.

Fix risk: Same routing geocode proxy — RoutingClient and account-geocodes depend on unauthenticated access.

Fix effort: Add withRateLimit + requireAuth (or internal token); optional response caching.

Unlike app/negative-slots/page.tsx (~112–117) and app/licenses/page.tsx (~127–130), app/geronimo/GeronimoClient.tsx has no analytics/AI permission gate. Every Greco member including viewers always gets full generate/print/export — inconsistent with permission matrix on sibling slot tools.

Fix effort: Wire getToolPagePermissions('Geronimo') like negative-slots — gate export buttons.

app/api/dashboard/custom-cards/route.ts (~48–66) runs select('*') on custom_dashboard_cards with no company_id SQL filter, then filters in JS by target_user_ids / target_company_ids. Service-role query pulls cross-tenant rows on every dashboard load — multi-tenancy leak in memory plus unnecessary scale cost as card count grows.

Fix effort: Add .or(target_user_ids.cs.{id},target_company_ids.cs.{companyId}) SQL filter — stop full-table select.

app/api/greco/session/route.ts (~23–33) returns session_date + updated_at for the 200 most recent DockSheet days with no authentication. /timer bootstrap calls this (~343–347). Remote callers can fingerprint which warehouse days had receiving activity without loading appointment payloads.

Fix risk: Removing or gating list=dates breaks date-picker UX in timer/inbound that enumerates sessions without login.

Fix effort: Require session or CRON_SECRET for list=dates; or return only last 7 days for public timer.

getProjectChats and getSupportThreads (~437–494) query without company_id, then filteredData = filteredData.filter(...) in JS. Fetches up to limit cross-tenant rows then discards — wrong total, wasted payload when a company filter is active.

Fix effort: Filter project_messages/support_messages by company_id in SQL before range().

app/api/admin/godview/route.ts updateUserRole (~893–900): service-role .from('profiles').update({ role: params.role }).eq('id', params.userId) — no verify target belongs to caller's company, no role enum whitelist in function (only HTTP handler trusts client JSON). Platform admin typo on userId can re-role another tenant's account.

Fix effort: Verify target profile.company_id and whitelist allowed roles before update.

app/api/cron/greco-digest/route.ts derives yesterdayStr from new Date().toISOString().split('T')[0] in UTC. For an Eastern warehouse, the 05:00 UTC cron (vercel.json) can digest the wrong calendar day relative to dock operations.

Fix risk: Changing digest window shifts which stats rows email includes — ops runbooks assume current behavior.

Fix effort: Use America/New_York date helper in greco-digest cron (same as forklift fix).

getMyGrecoCardDenials() in lib/supabase/greco-card-permissions.ts (~113–117) returns empty denial sets (full access) when the Supabase select errors — deliberate comment 'never accidentally hide tools.' Inverse risk: a transient RLS/network failure shows every denied tool/card again, defeating permission matrices until the query succeeds.

Fix risk: Fail-closed denies entire tool grid when Supabase blips — dock shift starts with empty Tools tab.

Fix effort: Fail closed to last-known denials in sessionStorage, or show 'permissions unavailable' and block tools tab.

supabase/migrations/114_create_greco_routes.sql line 18 defines company_id uuid not null with no REFERENCES companies(id). Same migration-hygiene class as tracked account_geocodes FK gap but greco_routes is the live routing planner table — orphaned UUIDs would pass RLS checks that compare to profiles.company_id only.

Fix risk: Adding FK on live data fails if orphan rows exist — needs cleanup migration first.

Fix effort: Migration: REFERENCES companies(id) ON DELETE CASCADE after verifying live UUID types.

app/api/cron/greco-digest/route.ts TOOL_COLUMNS (~27–31) lists dockvoo through driver_scan but omits geronimo, licenses, negative_slots, empty_slots, thruput, meat_count, incentives, items, schedule, etc. Daily digest agent_memory and anomaly baselines under-report which tools actually ran — even when those tools write greco_daily_stats.

Fix effort: Expand TOOL_COLUMNS to match DailyStatsClient TOOL_META keys — config change in greco-digest route.

app/api/cron/greco-digest/route.ts (~70–74) returns { success: true, message: 'No stats found… skipping' } when yesterday's stats row is missing. No retry queue or alert. If stats aggregation lags the cron, that day's digest/anomalies never land in agent_memory — quiet data loss.

Fix effort: Retry next run or alert when stats missing; don't return success: true on skip.

app/history/page.tsx load() catch (~103–104) and changeLoadLimit catch (~120–121) only console.error — never setLoadError state. HistoryLedger renders 'No activity recorded yet' (HistoryLedger.tsx ~545) when teamActivity=[]. Transient Supabase/RLS failure looks like quiet day. Export path (~181) sets exportError banner — load errors should match.

Fix effort: Add error banner like export path already has — history/page.tsx.

The initial and paginated loads in app/history/page.tsx catch errors with console.error only, then render the empty ledger. A transient Supabase failure is indistinguishable from a quiet day. (Export errors ARE surfaced — load errors should get the same treatment.) Project-chat sends in app/projects/page.tsx fail equally silently.

Fix effort: Same as History load errors — add error banner instead of empty ledger.

HistoryPanel catches load failures with console.error only; teamActivity stays [] and HistoryLedger shows empty feed. Transient failures inside embedded tool panels are indistinguishable from quiet activity — separate from the full /history page load issue.

Fix effort: Add error state banner in HistoryPanel.tsx like full /history page should.

app/components/HistoryPanel.tsx (~154–161) is a fixed overlay with Escape handler (~126–130) but no role='dialog', aria-modal, or aria-labelledby. Embedded in CindyVue, Shorts and Shanetrée modals — screen-reader users may not perceive it as a modal surface. Other modals' a11y gaps are tracked separately.

Fix effort: Add role='dialog' aria-modal aria-labelledby to HistoryPanel overlay container.

PUT app/api/ide/workspaces/[id]/files/route.ts (~139) accepts unbounded content strings. Combined with Monaco onChange calling saveFileContent on every keystroke (app/ide/page.tsx ~500), a large paste can POST megabytes per edit.

Fix effort: Cap content length on PUT; debounce Monaco saves (tracked separately).

app/ide/page.tsx MonacoEditor onChange calls saveFileContent immediately for every character typed — a PUT per keystroke (optimistic local update + network). Creates API storms, version-contention reloads and unnecessary DB writes during normal typing.

Fix effort: 300ms debounce on saveFileContent in ide/page.tsx onChange.

app/ide/page.tsx initial loads use .catch(() => {}). Create/delete file paths do if (!response.ok) return with no user feedback. Failed workspace creation also returns quietly. Operators get no toast or inline error when saves, deletes or loads fail.

Fix effort: Toast or inline error on !response.ok paths in ide/page.tsx.

app/inbound/InboundClient.tsx Schedule Outlook section (~704–762) shows upload history (details/summary), PO diff counts (+added / -removed vs previous upload) and refresh/hide controls on the public /inbound kiosk. Floor operators see backend scheduling metadata meant for admins — adds visual noise and leaks operational churn on a scan-first screen.

Fix effort: Hide upload history, PO diff and refresh behind admin flag or move to /controls; kiosk shows search results only.

app/api/internal/shanetree-autopull/route.ts parses full JSON body (~124) and writes pulled_data to shanetree_snapshots/pull log (~144+) with no payload size cap. Tracked issue covers hardcoded SHANETREE_AUTOPULL_USER_ID; this is separate — compromised INTERNAL_API_SECRET could POST multi-megabyte ODBC payloads into snapshot rows.

Fix risk: Adding caps breaks export or load-all flows that depend on fetching entire tables.

Fix effort: Reject bodies >4MB before snapshot insert — align with relay payload cap comments.

apiKeyCache.invalidateCompany(companyId) in lib/cache/service.ts accepts a companyId and then ignores it — it runs cacheDeletePattern('fd:api_key:*'), evicting all companies' cached key hashes. Revoking one tenant's key causes a global cache stampede of re-auth DB lookups. Relatedly, /api/cache's invalidate_user action accepts any target userId without checking it belongs to the caller's company.

Fix risk: Per-tenant cache key is correct fix but changes thundering herd timing — all tenants re-auth on any revoke.

Fix effort: Same scoped cache invalidation.

/api/jobs/enqueue lets any authenticated session enqueue ai_analysis, batch_email, embedding_generation and data_export jobs with arbitrary payloads, with no rate limit — a single misbehaving client can flood QStash and background_jobs with expensive work while sibling routes are throttled.

Fix effort: Add withRateLimit to /api/jobs/enqueue.

lib/supabase/team-chat.ts still exports sendTeamMessage, getTeamMessages, getRecentTeamMessages and deleteTeamMessage (~175 lines) targeting team_chat_messages, but grep finds zero imports outside that file. Live /team-chat uses lib/supabase/chat-rooms.ts (sendChatRoomMessage, subscribeToChatRoomMessages). Leftover from pre–chat_rooms migration — confuses readers and duplicates mention-insert logic.

Fix effort: Delete sendTeamMessage/getTeamMessages/getRecentTeamMessages/deleteTeamMessage from team-chat.ts or migrate last caller; keep mention helpers.

The 271-line client module mirrors lib/anomaly/service.ts, but only detectAndNotifyAnomalies and extractForkliftMetrics are imported (app/forklift/page.tsx). getRecentAnomalies, acknowledgeAnomaly, dismissAnomaly, extractPickerMetrics and extractLoaderMetrics in the client file have zero callers — API routes use service.ts directly. ~185 lines of duplicate dead wrappers.

Fix risk: Deduping parallel implementations must update every copy or behavior drifts again.

Fix effort: Keep only detectAndNotifyAnomalies + extractForkliftMetrics in client module; delete duplicate wrappers.

app/entree/MapPanel.tsx CACHE_KEY = filedisplay:accounts-map:v1 (~49) with no userId or companyId suffix. Shared bridge PCs inherit another operator's cached Entrée accounts roster, geocodes and salesman filters — wrong map pins until manual refresh.

Fix risk: Namespacing keys resets shared-PC preferences until users reconfigure.

Fix effort: Suffix CACHE_KEY with userId or companyId in MapPanel.tsx — match dashboard hidden-cards pattern.

lib/supabase/meat-counts.ts listMeatCountsForRange() (~314–329) has no .limit(); listMeatCountUploads() pulls .limit(5000) rows then reduces client-side (~350–354). Large date ranges can pull entire meat_counts partitions into browser memory on /meat-counts analytics tabs.

Fix effort: Add .limit() on listMeatCountsForRange; paginate analytics tabs.

app/members/page.tsx loadOrganizationMembers and loadLeaderboard catch errors with console.error only. UI renders 'No team members found' / 'No activity data yet' with no distinction from a real empty roster or a transient Supabase failure.

Fix effort: Distinguish error state from empty roster in members/page.tsx.

app/members/page.tsx member detail overlay is a fixed inset-0 div closed only by backdrop click or X button. No role='dialog', aria-modal, Escape handler or focus trap — keyboard users can't dismiss it or tab through actions safely. Same accessibility gap class as the calendar grid.

Fix effort: Add Escape handler, focus trap, role=dialog on members overlay.

app/api/cron/memory-cleanup/route.ts discovery loop breaks when newCompanyIds.length === 0 even though more expired agent_memory may exist. If one tenant dominates the first 500-row batch, other tenants' expired rows are never discovered that run.

Fix effort: Don't break on newCompanyIds.length === 0 until query returns zero rows; or DISTINCT company_id query.

vercel.json schedules job-retries every minute and stale-jobs every two minutes — ~2,900 authenticated invocations a day before the other seven jobs. All routes exist and all check CRON_SECRET, but the density is real function-invocation and Supabase load for queues that are usually empty. Worth stretching the intervals or moving retry logic into the worker itself.

Fix effort: Stretch job-retries and stale-jobs intervals in vercel.json if ops agrees.

vercel.json lists 9 crons: job-retries */1 * * * * (~line 4) and stale-jobs */2 * * * * (~line 9) fire every 1–2 minutes; plus agent-autonomy */10, webhooks */5, port-ai-summary hourly, etc. ~2,900 invocations/day from the two fast crons alone. Routes check CRON_SECRET but queues are often empty — real serverless + Supabase load for retry sweeps that could run inside workers or at 15-min intervals.

Fix effort: Stretch job-retries to 5m, stale-jobs to 5m in vercel.json — config-only if ops agrees.

LICENSE.md and AGENTS.md exist (Cursor Cloud oriented) but no human CONTRIBUTING.md (branch naming, commit style, moneyfund push remote, problems-page workflow). No CODEOWNERS for app/api/, supabase/migrations/, or entree-bridge.js. External collaborators or future hires lack a single 'how we work' entry point beyond scattered .cursorrules.

Fix effort: Add CONTRIBUTING.md from .cursorrules + commit style; CODEOWNERS for migrations and api/.

There's no middleware.ts and next.config.ts defines no headers() — the app ships without CSP, HSTS, X-Frame-Options, X-Content-Type-Options or Referrer-Policy. For a multi-tenant SaaS with admin routes and public kiosk pages, a baseline headers() block in next.config is cheap insurance against clickjacking and MIME sniffing.

Fix effort: Same next.config.ts headers block.

No middleware.ts and next.config.ts defines no headers() — the app ships without CSP, HSTS, X-Frame-Options, X-Content-Type-Options or Referrer-Policy. Baseline headers() in next.config is cheap insurance for a multi-tenant SaaS with admin routes and public kiosk pages.

Fix effort: Add headers() block in next.config.ts (CSP may need iteration) — ~20 lines, test on Vercel preview.

lib/supabase/notifications.ts updateNotificationSetting() (~181–183) and updateNotificationSettings() (~217–220) return { success: true } when the relation does not exist. Account email toggles look saved on fresh/partial DBs but persist nothing — operators think notifications are configured when the table was never migrated.

Fix effort: Return success:false when relation missing; surface 'notifications not configured' in account UI.

/api/v1/calendar/events and /api/v1/calendar/available-slots work with API keys, but grep 'calendar' in app/api/v1/openapi.json/route.ts returns zero matches — no Calendar tag or paths. Developer docs treat OpenAPI as the v1 contract; calendar is invisible there (batch blocking is tracked separately in API & Operations).

Fix effort: Add /api/v1/calendar/events and available-slots paths to openapi.json route.

app/picker/page.tsx header packs AI, Analytics, Filters and Test toggles with labels hidden sm:inline (~1377–1438). On warehouse phones operators see four identical-looking icon buttons with no text — easy to tap the wrong mode (e.g. Test vs Filters).

Fix effort: Show abbreviated labels on xs, tooltips with aria-label, or collapse secondary toggles into one menu.

supabase/migrations/121_create_port_summary_memory.sql adds expires_at with a comment that a prune task is coming, but daily memory-cleanup cron only calls pruneExpiredMemory() on agent_memory. port_summary_memory rows with past expires_at accumulate and keep feeding /port AI context.

Fix effort: Extend memory-cleanup cron or add pruneExpiredPortSummary() for port_summary_memory table.

app/api/jobs/route.ts POST (~148–192) verifies session + company_id ownership but has no role gate — viewers can cancel/retry background jobs. No withRateLimit on cancel/retry path. Expensive ai_analysis or export jobs can be disrupted or re-queued by any authenticated seat.

Fix effort: Require editor+ role for cancel/retry; add withRateLimit on POST.

lib/realtime/useCompanyPresence.ts loads full_name async (~43–61) into userName state, but presence channel join effect deps are [companyId, userId] only (~77) — initial track uses userName || 'User' at ~85 before profile resolves. Auto-update effect (~153–157) syncs page/resourceId/mode but not userName. updatePresence callback deps [userId] only (~149). Collaborators who connect before profile fetch completes stay labeled 'User' for the session.

Fix effort: Add userName to useCompanyPresence effect deps or re-trackPresence after profile loads.

Account exposes project_updates (app/account/page.tsx ~67). notifyProjectUpdate() exists in lib/notifications/trigger.ts but grep finds zero callers outside its definition — no project status change anywhere triggers it. Third decorative notification category beside the tracked chat/mention gaps.

Fix risk: Wiring latent toggles suddenly enables or blocks behavior users assumed was active.

Fix effort: Call notifyProjectUpdate on status change in projects flow, or hide toggle.

app/projects/page.tsx useEffect calls loadQuoteSubmissions() on mount with no auth check. getUserQuoteSubmissions() throws 'You must be logged in' which is caught and console.error'd — logged-out visitors see an empty projects list with no redirect. Auth is only checked inside sendProjectChatMessage().

Fix effort: Redirect to /login when getUserQuoteSubmissions throws or on mount session check.

GET /api/public/will-call-print-request with no id param (route.ts ~138–165) returns up to 5000 invno values where requester='sales' and status IN (pending, printing, done) — unauthenticated. Reveals operational print history to anyone on the internet; complements tracked print-once UX bug with a separate data-disclosure angle.

Fix effort: Require kiosk token or remove unscoped GET; scope printed list to authenticated staff.

Beyond homepage-bg-theme and greco guard cache (tracked elsewhere): /window persists window-my-requests + window-theme (WindowClient.tsx ~35–36), /sales uses sales-theme (~54), /timer uses timer-theme (~27). Shared dock PCs inherit prior visitor appointment lists and dark/light preferences — no user or company suffix on keys.

Fix risk: Locking down public kiosk APIs without token replacement breaks wall-mounted workflows.

Fix effort: Suffix window/sales/timer theme and request keys with session id or kiosk device label.

app/api/public/shanetree-latest/route.ts selects user_id on every row (~81–83) and returns the full snapshot including payload. useShanetreeSnapshot.ts embeds user_email and user_id inside payload.__meta (~60–61, 170–172). Kiosk readers on /adrian, /noe and /inbound therefore see who captured routes, will-calls or schedule data — PII on a world-readable endpoint.

Fix effort: Strip user_id and payload.__meta from public response; keep full row on authenticated snapshot API.

v1 tools/generate returns share_url at /t/{share_id} and app/t/[id]/page.tsx renders public tools, but build/page.tsx links to /custom-tools/{id} (auth required) and never shows 'copy public link.' Public-share infrastructure works; product UI never exposes it to builders.

Fix effort: Show copy-share-link on build/custom-tools success; surface share_url from v1 generate.

POST /api/public/window-appointments validates DATE_RE and TIME_RE only (~216–220) — no comparison to today and no whitelist against buildTimeSlots() in lib/window/constants.ts (~101–108). Client uses min={localTodayStr()} (WindowClient.tsx ~362) but direct API calls can book 2020-01-01 at 03:17 outside the 7:00–16:30 grid the UI shows.

Fix effort: Reject date < today and time not in buildTimeSlots() whitelist server-side.

app/quote/page.tsx accepts arbitrary file count/size via <input type='file' multiple /> with no size check. lib/supabase/quote-submissions.ts encodes every file to data_base64 in quote_submissions.file_attachments JSONB with no server guard — large spreadsheets can blow request size and Postgres row weight.

Fix effort: Client max size check + server rejection in quote-submissions.ts (e.g. 5MB/file).

Each report card footer (~2577–2633) packs timestamp, 'include input file?' checkbox, settings gear and Send Email button into one flex justify-between row. On mobile the checkbox label (text-[9px]) and Send Email button compete for width — actions wrap awkwardly or truncate beside the timestamp instead of stacking.

Fix effort: Stack footer on sm breakpoint — timestamp row, then checkbox, then action buttons; or move include-input into settings modal.

app/reset-password/page.tsx onAuthStateChange sets sessionReady on PASSWORD_RECOVERY or SIGNED_IN, and getSession() also sets sessionReady for any existing session (lines 36–39). A normally logged-in user visiting /reset-password can set a new password with no old-password confirmation — blurs recovery vs in-session password change.

Fix effort: Only set sessionReady on PASSWORD_RECOVERY event, not generic SIGNED_IN/getSession.

/api/routing/routes, /api/routing/routes/[id] and /api/routing/ai-build authenticate any user with profiles.company_id (routes/route.ts ~12–33) — no NEXT_PUBLIC_GRECO_COMPANY_ID pin unlike driver-chat requireGrecoUser(). On a multi-tenant deploy, non-Greco companies can store routes in greco_routes and invoke routing AI. Concrete unguarded surface beyond the broad Greco-hardcode note in older audit sections.

Fix risk: Pinning to Greco UUID breaks routing tool for any future non-Greco tenant already using /routing.

Fix effort: Pin routing routes to GRECO_COMPANY_ID like driver-chat requireGrecoUser.

freshRoute() in app/routing/RoutingClient.tsx (~96) sets date: new Date().toISOString().split('T')[0]. Eastern evening dispatchers opening a blank route get tomorrow's route_date before touching the picker — same warehouse-clock skew as Entree todayStr() (pass 10) but /routing is a separate daily workflow.

Fix risk: Date boundary changes reorder stats, leaderboards, and filters keyed on existing date columns.

Fix effort: Use shared warehouseLocalDateStr() in freshRoute() like other Greco date fixes.

app/api/public/sales-relay/route.ts (~116–134) inserts into shanetree_relay_requests with no per-date/invno dedupe or cooldown. Day-switching, refresh loops or multiple /sales kiosks can stack duplicate /will-calls jobs for the same date. Claim RPC global scope is tracked separately — this is enqueue-side duplication.

Fix effort: Dedupe pending jobs for same endpoint+date/invno before insert.

git tracks scripts/fake-lockscreen/ (PowerShell + VBS lock-screen overlay) and scripts/popup-killer/ (auto-close print dialogs) — 8 files with autostart installers. Legitimate for a dedicated bridge PC playbook, but jarring in a multi-tenant SaaS repository a customer or auditor might clone. Relocate to bridge-deploy/ or a private ops repo; keep only scripts/refresh-platform-stats.mjs and migration helpers in the product tree.

Fix effort: Move to bridge-deploy/ or private ops repo; remove from main product tree.

AGENTS.md, MULTI_TENANCY_SETUP.md, SHANETREE_REMOTE_SETUP.md, TOOL_REPORTS_SETUP.md, COMPANY_ID_VS_EMAIL_DOMAIN.md, QUICK_START.md and LICENSE.md share root with package.json. No docs/ index, no mkdocs/vitepress site, no cross-links. Professional OSS/SaaS repos use docs/ or a single DOCUMENTATION.md hub — root looks cluttered to GitHub visitors and Vercel importers.

Fix effort: Create docs/; move setup markdowns; add docs/README.md hub linking AGENTS + QUICK_START.

app/api/internal/shanetree-autopull/route.ts (~177–190) inserts status:success into shanetree_pull_log before shanetree_snapshots insert (~222+). On snapshot failure it writes error log (~242–256) but leaves the earlier success pull row — Pull Log shows completed pull with no matching snapshot for operators debugging auto-pull.

Fix effort: Insert pull_log only after snapshot succeeds, or update status to failed on snapshot error.

getMyDeniedModals() in lib/supabase/shanetree-modal-permissions.ts (~92–96) returns an empty Set (full modal access) when the Supabase read fails — mirror of greco_card_permissions fail-open. A transient RLS/network error unlocks modals an admin denied in /controls until the query succeeds.

Fix risk: Fail-closed change denies access on transient errors — opposite of today's permissive behavior.

Fix effort: Fail closed to last-known denials in sessionStorage or block Entree until permissions load.

lib/supabase/shanetree-pull-log.ts and shanetree-snapshots.ts order by created_at DESC scoped to a company. Migrations 116 and 118 index company_id and created_at separately, not as (company_id, created_at). Postgres must combine two indexes or sort a larger slice as pull-log and snapshot volume grows.

Fix effort: Migration: CREATE INDEX ON (company_id, created_at DESC) for both tables.

lib/supabase/ai-conversations.ts exports logAIConversation() (~35), getAIConversationsWithComments() (~128), getAIConversationsByUser() (~178), addConversationComment() (~204), deleteConversationComment() (~258) and getConversationComments() (~282) — all with zero external callers. Dashboard uses getAIConversations + subscribeToAIConversations only; comment CRUD and enriched list queries were built but never surfaced (~250 lines). subscribeToAIConversationComments orphan is tracked separately in Hygiene.

Fix effort: Delete comment CRUD exports or add dashboard conversation thread UI.

app/team-chat/page.tsx New Chat overlay is a fixed inset-0 div with no role='dialog', aria-modal, Escape-to-close or focus trap. Keyboard users cannot dismiss it safely or tab through member selection — same class as the Members modal gap.

Fix effort: Add role=dialog, aria-modal, Escape handler and focus trap to team-chat New Chat overlay.

grep logReportGeneration and notifyReportGenerated under app/thruput/ returns zero matches. Every other major warehouse report tool emits team_activity_log rows and optional email/webhook notifications on save. Thruput night-shift data stays invisible to Daily Stats Analytics Log, leaderboard scoring and notifyReportGenerated subscribers.

Fix effort: Call logReportGeneration + notifyReportGenerated on saveThruputDay like other warehouse tools.

lib/custom-tools/bridge.ts responds { success: true, fallback: true } to the iframe when /api/custom-tools/data returns an error or throws (lines 648–656). Custom tools and Build preview show success while data exists only in browser localStorage — silent data loss on shared machines or after cache clear.

Fix effort: Return success: false to iframe on API failure; let tool show error instead of silent localStorage fallback.

lib/custom-tools/bridge.ts (~434–435) uses fd_toolapi_fallback_${toolId} when cloud save fails. Tracked preview keys (fd_build_preview_tool_data_v1) are separate — this persisted-fallback path bleeds across operators on shared warehouse PCs.

Fix risk: Cloud-save failure path bleeds tool state across logins — fix changes offline fallback semantics.

Fix effort: Prefix fd_toolapi_fallback keys with userId like preview storage fix.

lib/inbound/item-alerts.ts:172 exports triggerItemReceivedAlert() for the 'item received' email stage. app/api/dockvoo/notify/route.ts imports and calls triggerItemCheckedInAlert only (~148). The received-stage alert path and its email template wiring are dead — operators never get the intermediate notification even if item_received template exists in EmailService.

Fix effort: Call triggerItemReceivedAlert from dockvoo notify earlier stage or remove item_received template path.

app/api/v1/batch/route.ts (~136–179) runs all operations concurrently with no concurrency cap. Large batches (reports + search + files) can hammer rate limits, Postgres and downstream APIs simultaneously — thundering herd from a single API key.

Fix risk: Serializing ops changes latency profile; rate limits may trip differently for batch clients.

Fix effort: Add concurrency limit (e.g. p-limit 3) over batch operations — batch/route.ts.

app/api/v1/filters/route.ts requires filter_prompt as a string (~78–80) but enforces no max length before upserting into ai_report_filters (~95–107). API keys can store multi-megabyte prompts later injected into AI system instructions (including via v1 analyze).

Fix risk: Adding caps breaks export or load-all flows that depend on fetching entire tables.

Fix effort: Cap filter_prompt length (e.g. 8KB) — match ai_report_filters UI limits.

app/api/v1/reports/analyze/route.ts inserts user_id: '00000000-0000-0000-0000-000000000000' (~229) into tool_ai_analyses. Activity ledger, analytics attribution and per-user analysis history cannot distinguish which API key or operator triggered the run.

Fix effort: Store api_key.created_by or a dedicated api_service user per company — migration optional for history.

app/api/v1/search/route.ts maps every result field including content_text (~76). Semantic search can return large report/analysis text blobs to any API key with semantic_search + reports:read — bulk export surface beyond summaries, including PII from embedded report JSON.

Fix effort: Return content_summary only by default; opt-in include_full_text flag for API consumers who need it.

app/api/v1/schedules/[id]/route.ts (~103–117) updates cron/timezone/interval but leaves next_run_at stale. Operators editing a schedule's cron via API do not shift the next fire time — combined with write-only schedules table, edits look saved but timing semantics are broken.

Fix effort: Recompute next_run_at on PUT when cron/timezone/interval change — schedules/[id]/route.ts.

app/api/v1/tools/route.ts (~104) and v1 tools/[id]/data write created_by:apiKey.id, not the key creator's user UUID. custom_tools.created_by references auth.users(id) per migration 075 — corrupts attribution and may violate FK unless keys happen to match user ids.

Fix effort: Store apiKey.userId or key creator profile id instead of apiKey.id.

app/api/cron/webhooks/route.ts acquireCronLock upserts into cron_locks, but no migration creates that table (grep cron_locks in supabase/migrations returns zero). On error it returns true ('skip locking and proceed anyway'). With webhooks scheduled every 5 minutes, overlapping retry runs are possible.

Fix risk: Fail-closed change denies access on transient errors — opposite of today's permissive behavior.

Fix effort: Migration creating cron_locks table + keep fail-closed on lock miss if desired.

app/api/custom-tools/generate/route.ts (~416–428): when a valid API key matches x-api-company-id, x-api-user-id is trusted for attribution and downstream inserts without verifying the UUID belongs to the key creator. API consumers can attribute AI usage to arbitrary user IDs within the tenant.

Fix effort: Bind user id to API key creator profile; ignore client x-api-user-id except internal secret path.

loadSubmissions in app/quotes-admin/page.tsx selects all rows but RLS (migration 012 SELECT policy) limits to caller's company_id. Password gate + 'admin' UI imply platform-wide quote review; data is single-tenant unless the operator belongs to each company.

Fix effort: Use service-role /api/admin/submissions for list or relabel UI as company admin.

app/scan/page.tsx (~103–273) implements its own columnMatches(), required/unique/exclude scoring, and 0.7 auto-route threshold inline. lib/tools/detector.ts exports detectTool(), detectAllTools(), calculateMatchScore() with the same 0.7 threshold (~72) and TOOL_SIGNATURES from lib/tools/registry.ts. Scan page never imports detector.ts — two implementations that drift when column aliases change in processors.

Fix effort: Replace scan/page.tsx logic with lib/tools/detector.ts import — verify parity on test files.

app/window/WindowClient.tsx and app/windowadmin/WindowAdminClient.tsx have zero useLanguage imports. /sales uses bilingual t(en, es) throughout (SalesClient.tsx). Spanish-preference warehouse users get English scheduling and staff review UIs on the will-call booking path.

Fix effort: Wrap WindowClient and WindowAdminClient copy with useLanguage like SalesClient.

WindowAdminClient.tsx WillCallsPanel (~340–361) fetches only GET /api/public/shanetree-latest?modal=willCalls once on mount. Staff reviewing appointment requests cannot see will-call context for prior/future days without leaving admin for /sales or Shanetrée — limits operational review of booking backlog.

Fix effort: Add date picker + shanetree_snapshots or will_call_appointments query by date — WindowAdminClient.tsx.

git ls-files lists 18 paths ending in .exe, .bat, .vbs, or .ps1 — SumatraPDF.exe, start-shanetree-autoprint.bat, scripts/*.ps1, scripts/start-entree-bridge-hidden.vbs, heal-and-restore.ps1, etc. No CONTRIBUTING.md explains which are dev-only. Professional layout: ops/windows/ or bridge/ with a single SETUP-BRIDGE.md index linking install-bridge-autostart.ps1 and verify-architecture.ps1.

Fix effort: Consolidate under ops/windows/ with SETUP-BRIDGE.md index; gitignore or LFS for any remaining binaries.

ls app/ shows 79 top-level entries — forklift, picker, entree, timer, sales, controls, problems, phl, produce, etc. all siblings. No app/(warehouse)/, app/(kiosk)/, app/(admin)/ or app/(platform)/ route groups. Next.js supports parentheses groups without changing URLs; grouping would document IA, enable shared layouts per surface, and stop the app/ directory reading like an uncurated dump of every URL ever shipped.

Fix effort: Introduce app/(warehouse), (kiosk), (platform) route groups without URL changes — incremental moves.

app/components/AgentGenerativeUI.tsx (2,047 lines) static-imports recharts plus ResponsiveSankey, Chord, Bump, Stream, SwarmPlot, CirclePacking, Network, Sunburst, ParallelCoordinates, and Marimekko from @nivo/* (~13–23). app/chat/page.tsx and daily-stats/GrecoAnalyticsChat.tsx import it at module top — opening Team Chat downloads the full nivo suite even when the conversation has no generative UI widgets. Lazy-load per chart type from spec.kind.

Fix effort: Switch on spec.kind with dynamic(() => import('@nivo/sankey')) per chart type — reduces /chat first load; test all generative UI widget kinds.

app/entree/EntreeClient.tsx will-call/auto-print setInterval(..., 3_000) at ~27220 and ~27363. app/live/greco/page.tsx (~128–129) reloads full session every 10_000 ms without document.hidden check. Some EntreeClient heartbeat loops (~10787, ~11296) skip hidden tabs; not universal. dashboard 30s refresh and inbox check visibility — kiosk paths do not. Dock screens open all shift → sustained load for rarely-changing data.

Fix risk: Duplicate — EntreeClient and /live/greco polling is load-bearing for will-call print and session sync.

Fix effort: Same polling → Realtime/backoff pass.

app/entree/EntreeClient.tsx will-call claim and auto-print watchers use setInterval(..., 3_000) at ~27220 and ~27363 — some ticks skip when document.hidden, not all loops. /live/greco/page.tsx (~128–129) reloads full DockSheet session every 10_000 ms with no visibility gate. Shanetrée heartbeat loops use 5 min / 30 min intervals (~10787, ~11296) with hidden-tab skips on some paths only. Multiply by dock kiosks left open all shift — sustained Postgres reads for rarely-changing data.

Fix risk: Stretching intervals makes wall mounts show stale dock/session data — operators rely on 3–10s refresh during receiving.

Fix effort: Replace 3s/10s polls with Realtime or Page Visibility backoff — touches Shanetrée, live/greco, will-call loops.

app/api/jobs/workers/ai-analysis/route.ts (~179–196): when payload.sendEmailOnComplete and payload.emailRecipients are set, worker enqueues batch_email to arbitrary addresses under FileDisplay's Resend domain. app/api/jobs/enqueue/route.ts (~141–145) spreads user payload into enrichedPayload with no recipient allowlist. Any authenticated user can enqueue ai_analysis (ALLOWED_JOB_TYPES) with external emails — parallel open relay to tracked /api/email/send gap.

Fix risk: Allowlist must include legitimate batch_email paths from picker/forklift notify chains, not only company members.

Fix effort: Validate emailRecipients against company member emails in enqueue worker; reject external domains.

app/api/cron/ai-usage-rollup/route.ts (~26–29) selects all ai_usage_logs rows gte monthStart with no .limit() — entire current month across all tenants into monthLogs array. Second query (~92–96) pulls 8-day window for anomaly detection, also unbounded. Client-side for loops aggregate in Node. Busy month + many tenants → 1 GB Vercel memory exhaustion, stale rollups. Distinct from tracked upsert-failure gap — this is read-side scale.

Fix effort: Replace client-side loops with Postgres RPC GROUP BY company_id or chunked .range() pagination.

updateBaseline() in lib/anomaly/service.ts SELECTs the employee_baselines row, appends to recent_values and recomputes stats in JS, then upserts the whole JSONB back. Two reports processing in parallel for the same employee/metric silently drop one sample (last writer wins), quietly skewing the mean and std-dev the detector compares against. Needs a row lock, version column, or SQL-side aggregation.

Fix effort: Same concurrent baseline fix.

lib/anomaly/service.ts updateBaseline() (~162–191): SELECT employee_baselines row, push newValue onto recent_values in JS, recompute day_of_week_stats, upsert whole JSONB. Parallel report processing for same employee/metric/tool is last-writer-wins — one sample silently dropped, mean/std-dev skew. No row lock, version column, or SQL-side jsonb_set append.

Fix risk: Row locks during forklift save burst may slow report processing — trade throughput for accuracy.

Fix effort: SQL-side jsonb append RPC with row lock, or version column — lib/anomaly/service.ts refactor.

lib/anomaly/service.ts detectAnomalies() (~251–268) loops metrics sequentially, calling getBaseline() then updateBaseline() (each upserts employee_baselines) per employee/metric. A forklift report with 30 employees × 5 metrics can issue ~300 sequential queries on save — tracked baseline race is separate; this is per-save latency and connection churn.

Fix effort: Batch baseline fetch/upsert in one RPC or Promise.all with concurrency cap — lib/anomaly/service.ts.

The /problems audit itself lives in one page.tsx (NEW_CATEGORIES + CATEGORIES + tab UI). needs.tsx was extracted for Biggest Needs; ranked.ts, taxonomy.ts, fix-metadata.ts exist — but 22 audit passes still append to page.tsx. Next structural step: move NEW_CATEGORIES slices to app/problems/passes/*.ts or one file per pass. Prevents the documentation system from becoming the next EntreeClient-scale monolith.

Fix effort: Extract NEW_CATEGORIES to app/problems/passes/*.ts like needs.tsx pattern.

supabase/migrations/089_team_activity_log_archive.sql enables RLS on team_activity_log_archive with zero SELECT policies (service-role only). After activity-log-cleanup cron moves rows, they vanish from /history and HistoryPanel with no UI to query the archive.

Fix effort: Add SELECT RLS on archive matching company_id + optional /history?archive= UI.

lib/custom-tools/file-profiler.ts (~124–145) iterates all data rows per sheet. Build file mode (app/build/page.tsx ~631) runs this in-browser before generate-from-file — large uploads can freeze the tab before the API is hit.

Fix risk: Spreadsheet parser changes affect every upload tool — cell types and dates may shift.

Fix effort: Sample rows cap in file-profiler.ts; stream profile on server instead.

Grid view supports (a) clicking a day → bottom/side day panel with inline EventDetail cards (~806–860) and (b) clicking an event chip → expandedEventId fixed overlay (~864–878). Two different UIs for the same action; day panel and chip overlay can both be open conceptually but overlay only shows when !selectedDay. Confusing which click path to use.

Fix effort: Pick one path — day panel OR chip overlay — and remove the other; or unify into a single EventDetail drawer.

app/calendar/page.tsx grid day cells (~712–714) are <div onClick={() => setSelectedDay(day)}> with no role='button', tabIndex, or onKeyDown. EventFormModal (~188) is fixed inset-0 overlay closed by backdrop click only — no role='dialog', aria-modal, or Escape handler. Keyboard users cannot select days or dismiss the create/edit modal via standard patterns.

Fix effort: Add role=button, tabIndex, onKeyDown, focus trap + Escape on event modal — calendar/page.tsx.

lib/supabase/member-permissions.ts exports canAccessTool() (~304) with zero imports outside the module. Legacy tool_access rows are not consulted on /forklift, /picker or other routes — only dashboard card filtering via greco_card_permissions (and even that is cosmetic per pass 10). Member Permissions 'tool access' toggles may be decorative for direct navigation.

Fix effort: Call canAccessTool in GrecoOnlyGuard or delete member_permissions.tool_access if greco_card_permissions is canonical.

app/controls/ControlsClient.tsx sections (~45–52): cards, tools, modals, team, appearance, tabs, permissions — no email/notification matrix. Per-tool email recipient admin lives only in the unwired dashboard modal and Reports-tab gear icons. Controls subtitle promises 'everything for your Client ID' but omits the email surface founders configure via member permission flags.

Fix effort: Add Email section to Controls wiring report_email_settings + AI filters, or wire dashboard modal.

ModalAccessSection title 'Window Access' (app/controls/sections/ModalAccessSection.tsx) drives shanetree_modal_permissions for Entrée modal keys only. Public /window posts to /api/public/window-appointments with no modal-permission check. Admins think they restricted 'Window' in Controls; customers can still self-book at /window.

Fix risk: Gating /window breaks public Will-Call kiosk URLs printed on QR collateral unless redirect target is preserved.

Fix effort: Either rename Controls section or add server flag to block window-appointments POST when disabled.

app/counting/CountingClient.tsx statically imports framer-motion (~39) and six recharts components (~45–54). Opening /counting downloads animation + chart libraries before any chart renders — not covered by tracked picker/shorts recharts notes or ExcelJS CDN list.

Fix effort: dynamic() CountingCharts child with lazy recharts; reduce framer-motion to CSS transitions where possible.

app/live/greco/page.tsx relies heavily on text-[9px]–text-[11px] for status badges, PO numbers, building/layout chips and table cells (~161–643); compact mode goes down to text-[7px]–text-[8px]. Designed for dense data on a monitor, but wall-mounted kiosk TVs at 10–15 feet make PO numbers and status labels hard to read at a glance.

Fix effort: Add kiosk/wall mode with scaled type (text-sm+), larger PO badges and optional TV layout preset.

app/api/notifications/document/route.ts POSTs directly to Resend (~154–166). Failed-send counting on document route may be tracked separately — this angle is the missing audit trail: no email_logs rows for team document-share notifications, unlike session email paths through NotificationService.

Fix effort: Route document POST through NotificationService.send or insert email_logs rows after Resend — notifications/document/route.ts.

app/documents/page.tsx content_diff handler applies remote edits only when !hasUnsavedChanges — comment mentions 'or if the remote change is newer' but there is no timestamp comparison. Two concurrent editors get silent divergence with no conflict banner.

Fix risk: Same collaboration conflict — merge strategy choice affects multi-editor docs sessions.

Fix effort: Add timestamp/version conflict UI or merge strategy when both editors have unsaved work.

app/inbox/InboxClient.tsx has zero useLanguage imports — thread list, AI toggle copy, send errors and settings strings are hardcoded English. Sibling /routing wraps LanguageProvider and bilingual t(en, es) throughout RoutingClient.tsx. Spanish-preference operators can use Shanetrée in Spanish but respond to drivers in an English-only inbox.

Fix effort: Wrap InboxClient copy with useLanguage/t(en,es) like RoutingClient.

supabase/migrations/129_create_driver_chat.sql INSERT policy only checks company_id membership — any company member can insert rows with sender: 'driver'. /inbox correctly uses /api/driver-chat/send (forces sender: 'greco'), but a browser client could spoof driver messages directly.

Fix effort: Migration: INSERT WITH CHECK sender IN ('greco','ai') for authenticated role, or force all inserts through send API only via revoked direct INSERT.

lib/supabase/tool-reports.ts (~1928–1974) inserts/selects driver_scan_reports. Migrations only ALTER it (113_add_excluded_to_tool_report_tables.sql). Same migration-gap class as tracked greco_daily_stats and firmas_entries — fresh Supabase environments cannot reproduce Driver Scan persistence from migrations alone.

Fix effort: Add migration CREATE TABLE driver_scan_reports with company_id + RLS — export from hosted schema.

lib/email/service.ts generateEmailHtml() embeds ${data.*} directly in HTML (anomaly_alert ~593–595, marketing ~461–462, new_chat_message preview ~416, agent_notification ~487–489). Crafted display names, previews or anomaly text in outbound data can inject HTML into company-branded email bodies.

Fix effort: HTML-escape all ${data.*} interpolations in generateEmailHtml — lib/email/service.ts.

lib/email/service.ts defines sendWelcome() (~323–332) with welcome HTML template (~357+) — grep finds zero callers outside the definition. agent_digest is registered in EmailTemplate (~26), mapped to weekly_digest prefs (~71), with HTML (~498+) but no route, cron or job worker invokes template: 'agent_digest'. Signup onboarding and agent weekly digest UI toggles have no sender path.

Fix effort: Wire sendWelcome on signup confirm + cron/job for agent_digest, or remove templates and UI toggles.

CindyVueClient saves driver signatures via saveFirmaEntry/getFirmasForDate/deleteFirmaEntry in lib/supabase/tool-reports.ts (~1867–1902) against firmas_entries. lib/agent/greco-tools.ts lists firmas_entries in allowed SQL tables. No migration file creates the table or RLS — same migration-gap class as greco_daily_stats but for DockSheet signature photos.

Fix effort: Migration for firmas_entries + storage bucket refs; mirror greco_daily_stats RLS pattern.

Domain logic also lives in app/cyclecount/lib/, app/drivers/lib/, app/transfers/lib/ and app/tools/greco/lib/ (items-engine, schedule-engine, excel-exports). Rest of the codebase uses lib/ at repo root. Inconsistent import mental model: some tools import @/lib/tools, others reach into app/tools/greco/lib. Consolidate Greco engines under lib/greco/ (today only greco-tools.ts + greco-cards.ts) or lib/tools/greco/.

Fix risk: Deduping parallel implementations must update every copy or behavior drifts again.

Fix effort: Move app/tools/greco/lib/* to lib/greco/; same for cyclecount, drivers, transfers engines.

app/geronimo/page.tsx header (~18–22) says it was lifted out of Window Low Slots 'standalone of the entrée bridge — drop the Dakota xlsx and go, no ODBC dependency, no demand pipeline.' app/empty-slots/page.tsx (~16–17) has no Supabase reads/writes. Both consume BFC Dakota R08921s only — no fourWeekAvg short-dollar ranking, no arslot context, no tie to the ODBC demand that makes Window Low Slots actionable. Enterprise slot planning needs both planes on every surface.

Fix effort: Optional ODBC demand overlay on Geronimo/Empty Slots (reuse /low-slots + dakota-merge) — mode flag for bridge-less vs full merge.

app/api/admin/godview/route.ts getCompanies() (~307–314) runs Promise.all of four count queries per company (profiles, quote_submissions, team_chat_messages, shared_documents) — 4×N companies per GodView Companies tab load. Agent section in app/components/GodView.tsx (~3430+) fetches all companies then per-company stats. app/api/monitoring/metrics/route.ts getJobMetrics (~142–165) selects all background_jobs.status rows into JS and filters in memory — no GROUP BY, no .limit().

Fix effort: Replace per-company counts with SQL aggregate RPC; godview + monitoring routes.

When isGreco is true, loadDashboardData (~1274–1293) runs Promise.all with seven head-count queries (forklift, picker, replen, returns, shorts, skips, truck_errors) plus four recent-activity selects — 11 round-trips before the Stats tab is ever opened. Non-Greco tenants skip this, but every Greco operator pays the cost on every dashboard load and refresh. A single RPC or materialized daily rollup would collapse this.

Fix effort: Single RPC or daily rollup view returning counts + recent activity — migration + dashboard loader swap; test non-Greco tenants still skip.

Greco users get 10+ tab entries (Overview, Account, Shanetrée, DockSheet, Stats, Tools, AI, Workspace, Docs, Reports, Support) in one horizontal scroller at text-[10px] with only a right-edge gradient hint. Discoverability suffers — operators scroll sideways hunting for the tab they used yesterday; no grouping or 'More' overflow menu.

Fix effort: Group external links under More menu, collapse Greco shortcuts, or promote Workspace folder over duplicate tab entries.

GET /api/greco/session (full dock session for any date), /api/greco/analytics-log, /api/greco/custom-appointments, /api/port/ai-summary/memory and /api/entree/query serve operational data without authentication so kiosk pages (/inbound, /timer, /live/greco) work. Trade-off may be acceptable but is implicit — a shared kiosk token or documented allowlist would make the boundary deliberate.

Fix risk: Adding auth breaks /timer, /inbound, /live/greco, /noe without a kiosk token story — public GET is load-bearing for wall mounts.

Fix effort: Product decision first: shared kiosk JWT vs documented allowlist vs IP allowlist — then implement consistently across ~5 routes.

“Comment on activity” links from the history page append ?prefill=…&activity=<id> to /team-chat, but team-chat only reads prefill and dm. The activity id — presumably meant to link the message back to the activity — is silently discarded. Similarly, /history?highlight=<id> is fully implemented on the read side (loads all, scrolls, highlights) but no code anywhere generates a highlight link.

Fix effort: Same activity param wiring.

app/history/page.tsx 'Comment on activity' links append ?prefill=…&activity=<id> to /team-chat, but team-chat only reads prefill and dm params. The activity id is never consumed — messages can't be linked back to the ledger entry. /history?highlight=<id> is implemented on the read side but no code generates highlight links.

Fix effort: Read ?activity= in team-chat, attach to message metadata or thread context — needs schema or message prefix convention.

app/history/page.tsx handleExportExcel (~175–177) calls getUnifiedHistory(0) whenever on-screen loadLimit isn't already 'all'. Tracked issues cover UI 'All' mode; this export button is a separate path that always pulls the complete merged ledger (team_activity + dock + print + pull) for Excel generation — multi-megabyte export even when UI shows 50 rows.

Fix risk: Export explicitly calls getUnifiedHistory(0) — cap breaks 'entire history' workbook promise on the button label.

Fix effort: Server-side export endpoint with date range + cursor, or cap export at visible filter window.

Cron runs sequentially per company with maxDuration = 300 while each generatePortAISummaryForCompany() is multi-step Gemini. Two companies × ~3 minutes risks a platform kill mid-loop — partial companies updated, rest skipped until next hour with no resume cursor.

Fix effort: Per-company time budget, cursor/resume state, or split into one-company-per-invocation queue.

app/ide/page.tsx preview iframe uses sandbox='allow-scripts allow-modals' and injects editor contents via srcDoc including a <script> block (createSandboxDoc). Any code the user or AI assistant writes runs in browser with script execution — self-XSS / prototype-pollution vector on shared machines, even if isolated from the parent origin.

Fix risk: Sandboxing breaks user snippets that depend on full DOM/window — IDE feature regression.

Fix effort: Tighten sandbox (drop allow-scripts for preview?), or run in isolated worker; balance IDE usefulness vs XSS on shared PCs.

ide_code_nodes is populated only by /api/ide/index, which has no UI caller. Dead routes /api/ide/context/search, /api/ide/patch and both assistant chat handlers read ide_code_nodes for symbol context — but with an empty table the 'semantic codebase awareness' feature can never return results. Appears functional in architecture docs; effectively useless on web IDE today.

Fix effort: Call /api/ide/index on workspace save from ide/page.tsx, or remove ide_code_nodes dependency from assistant routes.

GET /api/ide/workspaces/route.ts (~21–26) lists all ide_workspaces for company_id with no created_by filter. Every company member sees and can open/edit/delete files in coworkers' workspaces via ide/workspaces/[id]/files. Tracked IDE silent errors and per-keystroke saves compound the risk.

Fix effort: Filter workspaces by created_by; add shared-workspace flag if collaboration intended.

supabase/migrations/108_create_ide_user_settings.sql defines only user_id + settings blobs. Violates repo multi-tenancy rule (all tables need company_id REFERENCES companies). RLS is per-user only — no tenant anchor for audits, future multi-company users, or company-offboarding data cleanup.

Fix effort: Migration adding company_id + backfill from profiles; update settings-sync route to set it.

app/inbound/InboundClient.tsx has zero useLanguage imports — all copy ('Scan PO / Item', schedule upload history, POSTAT labels, error strings) is hardcoded English. Warehouse floor kiosks (/inbound, /timer, /live/greco) are Spanish-first in other tools (Controls language toggle + greco-lang-pref), but the highest-traffic public lookup screen never switches locale.

Fix effort: Wrap InboundClient copy with useLanguage/t(en,es) like other Greco kiosk pages.

app/incentives/IncentivesClient.tsx fetches routes from /api/public/shanetree-latest?modal=routes (~103) and computes case/stop payouts client-side. No upsertDailyStat, logReportGeneration, or Supabase writes under app/incentives/. Driver incentive numbers vanish on browser clear with no team_activity_log or Daily Stats entry.

Fix effort: Add incentives_runs table + upsertDailyStat + logReportGeneration on weekly export — payroll audit requirement.

app/incentives/IncentivesClient.tsx — EXCLUDED_KEY = 'greco.incentives.v1.excluded' and DAYS_KEY = 'greco.incentives.v1.days' (~23–24) with no per-user suffix (~34–53, 89–96). Shared warehouse PCs leak route exclusions and computed week history between operators — payroll-adjacent state should be server-backed or namespaced.

Fix risk: Namespacing keys resets shared-PC preferences until users reconfigure.

Fix effort: Namespace keys with userId or persist exclusions/days to Supabase incentives_settings table.

lib/supabase/meat-counts.ts replaceMeatCountsForDate() (~289–297) awaits deleteMeatCountsForDate() then upsertMeatCountsForDate() as two separate Supabase round-trips — no RPC, no transaction. deleteMeatCountsForDate() (~304–311) DELETEs by company_id + count_date; overlapping uploads (double-click, two operators, retry) interleave so one run's delete can land mid-insert — partial or empty day snapshot.

Fix risk: RPC transaction changes failure mode — partial day visible during upload may become lock contention.

Fix effort: Single RPC doing DELETE+INSERT in one transaction in supabase migration.

replaceMeatCountsForDate() in lib/supabase/meat-counts.ts issues a DELETE for the (company, date) rows and then a separate bulk upsert. Two overlapping uploads (double-click, two operators, a retry) can interleave so one run's delete lands mid-way through the other's insert — leaving a partial or empty day snapshot. A single RPC doing both in one transaction closes the window.

Fix risk: Duplicate title — same concurrent upload interleave risk vs fix behavior.

Fix effort: Same transactional RPC.

getMyFullPermissions() returns dashboardTabs from member_permissions.dashboard_tabs (lib/supabase/member-permissions.ts ~513), but grep dashboardTabs in dashboard/page.tsx returns zero matches. Dashboard only consumes toolAccess from permissions (~1566). Per-member tab ACL is computed and persisted but no page reads it — useless schema field today.

Fix risk: Applying stored tabs suddenly hides Workspace cards admins thought they configured — latent settings activate.

Fix effort: Read dashboardTabs in dashboard/page.tsx and filter tabs/cards, or drop column from schema.

app/members/page.tsx, app/support/page.tsx and app/history/page.tsx have zero useLanguage / t() usage. Tracked i18n gaps cover team-chat and documents — Spanish-preference Greco operators hit fully English member management, support tickets and activity ledger after switching language elsewhere.

Fix effort: Add useLanguage + t() passes on members, support, history pages — same as team-chat i18n effort.

app/api/monitoring/metrics/route.ts — getJobMetrics() selects all background_jobs (~142–146); getApiMetrics() pulls every api_activity_log row in 24h (~184–193); getAnomalyMetrics() pulls all anomalies in 24h (~224–233). No SQL-side aggregation or .limit() — grows with tenant volume and slows founder monitoring polls.

Fix risk: Adding caps breaks export or load-all flows that depend on fetching entire tables.

Fix effort: Replace full selects with SQL count/aggregate RPCs or head:true count queries per metric bucket.

Grep pass 22 beyond prior Dead Code categories: lib/agent/policy-verification.ts (~62 lines, zero imports), lib/routing/geocoder.ts (~109 lines, zero imports), lib/guide/printable-guide.ts (~1,200 lines, docs/whitepaper only), 13 unused Nivo render* exports in lib/agent/renderer.ts (~500+ lines), six ai-conversations CRUD/comment helpers (~250 lines), companyCache/statsCache write-only objects (~120 lines), npm packages ai + @ai-sdk/openai with zero source imports, plus ~25 orphan exports across member-permissions, chat-rooms, calendar, inbound alerts, Greco excel-exports, notifications, ai-filters, port-ai-summaries, shanetree-snapshots, greco-card-permissions, company-settings, individual-report-settings, documents, ai-chat-sessions, and duplicate type definitions. Total new maintainable surface that executes nothing in product flows: roughly 2,400–2,800 lines.

Fix effort: Batch-delete verified orphans in policy-verification, geocoder, unused render* exports, ai-conversations CRUD, orphan supabase helpers, and npm ai/@ai-sdk/openai; run tsc after each batch.

getPermissionPresets, savePermissionPreset, deletePermissionPreset and applyPresetToMember in lib/supabase/member-permissions.ts (~524–666) have zero callers outside that file. permission_presets table + RLS in migration 057 are maintained with no Controls or Account surface — dead schema beside the live matrix UIs.

Fix effort: Add presets picker to Controls MemberPermissionsSection or drop permission_presets table.

app/account/page.tsx (~749–753) reads avatar files with FileReader.readAsDataURL() and lib/supabase/account.ts (~148) persists the data URL to profiles.avatar_url. No file-size or MIME check; multi-megabyte images inflate profile rows and every presence/mention render that loads avatar_url. Should upload to Storage and store a URL (distinct from quote-attachment JSONB issue).

Fix effort: Upload to Supabase Storage avatars bucket; store public URL; add 2MB cap — account page + migration for existing rows optional.

app/api/public/inbound-relay, driver-chat and po-doc have zero withRateLimit calls (grep finds none under app/api/public/*). Each can enqueue bridge/ODBC relay jobs or trigger inline AI replies — abusable for cost and bridge load beyond the already-tracked item-alert-subscribe gap.

Fix risk: Rate limits on /api/greco/session, /api/entree/query, will-call relay can block wall mounts during receiving rush.

Fix effort: Add withRateLimit to inbound-relay, driver-chat and po-doc — per-IP for anon kiosk callers.

lib/jobs/service.ts executeAIAnalysisJob() is a stub returning { success: true } with no gateway call. When QStash is unavailable, enqueueJob falls back to synchronous execution and marks those background_jobs completed while doing zero analysis.

Fix effort: Implement real executeAIAnalysisJob or mark jobs failed when QStash unavailable instead of stub success.

lib/rate-limit.ts returns allowed: true whenever the check_rate_limit RPC errors (unless RATE_LIMIT_FAIL_CLOSED=true, which isn't set), and requests carrying no bearer token and no companyId skip limiting entirely — so public routes that call withRateLimit without auth context are effectively unlimited. The Redis API-key fast path in lib/api/auth.ts is also check-then-increment (two separate ops), so concurrent bursts slip past the per-minute cap.

Fix risk: Fail-closed change denies access on transient errors — opposite of today's permissive behavior.

Fix effort: Same rate-limit hardening.

lib/rate-limit.ts returns allowed when no companyId/bearer token and on RPC errors unless RATE_LIMIT_FAIL_CLOSED=true. /api/public/item-alert-subscribe, /api/dockvoo/notify and /api/jobs/enqueue have no withRateLimit at all.

Fix risk: RATE_LIMIT_FAIL_CLOSED=true or adding limits to dockvoo/notify can drop legitimate burst traffic from forklift save loops.

Fix effort: Set RATE_LIMIT_FAIL_CLOSED in prod, add withRateLimit to public routes, fix Redis race with atomic INCR — several files.

getAllPickerReports, getShortsHistory (when uncapped), getAllDriverScanReports, getUserFiles and getCompanyDocuments all select without .limit() — and several embed full JSONB report payloads per row. The picker page then flattens every row of every report into memory for client-side filters. Each works now; each degrades linearly with usage and none has a ceiling.

Fix risk: Adding caps breaks export or load-all flows that depend on fetching entire tables.

Fix effort: Same row caps + pagination.

lib/supabase/tool-reports.ts getAllPickerReports() (~494–512) .select('*') on picker_reports with no .limit() — embeds full picker_data + short_runner_data JSONB per row. lib/supabase/documents.ts getCompanyDocuments() (~82) selects all shared_documents. app/picker/page.tsx (~234–241) flattens every row of every report into allReportsData for client-side crew/name/scan filters. getShortsHistory (uncapped) and getUserFiles follow same pattern — linear degradation, no ceiling.

Fix risk: Adding caps breaks export or load-all flows that depend on fetching entire tables.

Fix effort: Add sensible .limit() defaults + pagination params to 4–5 supabase getters; update consuming pages.

app/docs/page.tsx (~1858–1859) documents Returns Intel expecting BFC Client ID per location. app/returns-intel/page.tsx aggregates week-over-week by that string with no lookup to Entrée CUSTNO/COMPANY (arcusto). Return Diffs normCust strips leading zeros (~20748) but Returns Intel does not — location-level return trends cannot roll up to salesman, credit terms, or Entrée customer master for enterprise reporting.

Fix effort: Lookup table or ODBC /customer?cust= join enriching Returns Intel rows with Entrée CUSTNO/COMPANY/salesman.

fetchOSRMRoute() in RoutingClient.tsx (~1232) hits https://router.project-osrm.org/route/v1/driving/… client-side with errors swallowed. No server proxy, auth or rate limit — distinct from tracked /api/routing/geocode (Nominatim). Road-distance mode exposes dispatcher client IPs to a third-party demo service and breaks if OSRM throttles or blocks the warehouse egress IP.

Fix effort: Proxy OSRM via /api/routing/osrm with rate limit; or bundle self-hosted routing.

GET /api/greco/session (full dock session data for any date), /api/greco/analytics-log, /api/greco/custom-appointments, /api/port/ai-summary/memory and the /api/entree/query bridge proxy serve data without authentication so the public kiosk pages (/inbound, /timer, /live/greco) work. That trade-off may be acceptable, but it's currently implicit — a shared kiosk-token or at least a documented allowlist would make the boundary deliberate rather than accidental.

Fix risk: Locking down public kiosk APIs without token replacement breaks wall-mounted workflows.

Fix effort: Same kiosk boundary decision + implementation.

app/shorts/page.tsx is the fourth-largest page file. It static-imports six recharts components (~25) and lib/supabase/tool-reports save/get helpers while also hosting upload parsing, row editing, history drawer, and AI summary UI in one component. Dock supervisors opening Shorts for a quick entry form download charting libraries before any chart renders. Split charts behind dynamic() or a ShortsCharts child.

Fix risk: Large single-file page — extracting or refactoring risks breaking embedded business logic.

Fix effort: Extract ShortsCharts child with dynamic() recharts import — 1–2 files; verify chart tab still renders after upload.

app/signup/page.tsx calls supabase.auth.signUp({ email, password }) (~23) with no domain allowlist/denylist before ensureUserProfile() (~26). Pairs with ensure_user_profile auto-company creation — personal emails create orphan tenants with full founder access.

Fix effort: Client + server domain allowlist or block personal-email providers before ensureUserProfile.

app/ide/page.tsx fetches only /api/ide/workspaces/* and /api/ide/assistant/chat (non-stream). These routes have zero fetch callers: /api/ide/index (~114 lines), /api/ide/patch (~462), /api/ide/context/search (~89), /api/ide/settings-sync (~89), /api/ide/assistant/complete (~99), /api/ide/assistant/chat/stream (~251). ~1,100 lines of semantic-index / patch / completion infrastructure maintained for a desktop extension that never calls them from the web IDE.

Fix effort: Wire web IDE to index/patch/context routes or delete ~1,100 lines if desktop-only extension is abandoned.

app/layout.tsx loads https://cdn.jsdelivr.net/npm/@supabase/supabase-js@2 (major-only) while package.json pins ^2.91.1 for server usage. lib/supabase/client.ts createClient() reads window.supabase from the CDN script, not the npm bundle — supply-chain exposure and version skew between CDN and server paths.

Fix effort: Bundle @supabase/supabase-js via npm import in client.ts, remove CDN script from layout — test auth persistence on warehouse machines.

app/support/page.tsx loads messages once on mount — no postgres_changes subscription or polling, so admin replies don't appear until refresh or the user sends again. getMySupportMessages() returns [] on error; handleSend never surfaces result.error. Failed loads look like 'No messages yet'; failed sends look like a no-op.

Fix risk: Realtime filter changes alter what live updates appear — easy to hide needed events.

Fix effort: Add postgres_changes subscription (like team-chat) + surface send/load errors in UI.

company_tab_settings / adminHiddenTabs is loaded on dashboard but consulted only twice — to hide Overview cards for tools and reports (~1838, ~1872). The tab strip, Workspace folder cards and <Link href='/team-chat'> never read adminHiddenTabs. Hiding 'Chat' or 'Members' in Account/Controls does nothing visible outside two card removals.

Fix effort: Apply adminHiddenTabs to tab strip, Workspace folder and external links — or rename feature 'Overview card visibility'.

team-chat exposes a notifications on/off toggle per room (chat_notification_settings table, lib/supabase/chat-rooms.ts toggleNotification). UI updates notifications_enabled and persists to DB, but handleSendMessage never reads the flag — no email, push, badge or mute logic consults it on send. Users think they muted a room; nothing changes. Useless control (~80 lines UI + table writes).

Fix risk: Wiring latent toggles suddenly enables or blocks behavior users assumed was active.

Fix effort: Implement mute check on send (email/badge) or remove toggle and chat_notification_settings table.

app/scan/page.tsx has its own copy of the column-matching/scoring logic that lib/tools/detector.ts already provides — the two can drift apart. Additionally, scan redirects to Reconciliation, Loader and Returns Intel with a sessionStorage scannerFile those three pages never read, so users arrive with nothing loaded (nine other tools do consume it).

Fix effort: Same detector consolidation.

supabase/migrations/ has colliding prefixes at 027, 028, 029, 030, 031, 032, 033, 055, 094, 095, 100, 130 and 132. Apply order depends on alphabetical tie-breaking; fresh environments may sequence conflicting changes differently than production.

Fix effort: Rename conflicting files to unique sequential numbers — must not re-run on prod; document apply order for fresh envs only.

app/docs/page.tsx (~788–806): Transfers ingests BFC Total Overstock xlsx (Hecht/Brewster/Rana tabs) only. No join to Entrée ONHAND, itemwhselocs, or arslot to validate whether BFC overstock positions match ERP inventory. Subs modal already correlates replenishment risk with DockSheet QTYREC — standalone Transfers and Replen (two BFC uploads, app/replen/page.tsx ~237, ~379) lack that receiving-bridge context.

Fix effort: Enrich Transfers rows with Entrée ONHAND + arslot via /stockvoo or item lookup — moderate ODBC fan-out per upload.

app/api/v1/files/[id]/route.ts (~56–64) uses Buffer.from(fileContent) with no size guard. Large user_files payloads can OOM serverless handlers — parallel to tracked JSONB bulk rows but specific to v1 files download path.

Fix effort: Stream from Storage with max size check, or reject files >N MB in files/[id]/route.ts.

app/api/v1/schedules/route.ts (~158–174) comments 'Calculate next run time' but assigns nextRunAt = now.toISOString() regardless of cron_expression / interval_seconds / timezone. Schedules never executing is tracked — even with a runner, first-run timing is wrong on create.

Fix effort: Use cron-parser or interval math to compute next_run_at from cron_expression + timezone.

Grep-verified orphans across this pass: ~720 lines of unused lib/supabase exports (legacy team-chat CRUD, team-activity helpers, anomalies client dupes, quote/chat/port/rate-limit helpers), ~74 lines unused lib/tools/index.ts barrel, ~800 lines duplicate /produce page, ~1,900 lines of API routes with zero fetch callers (six IDE routes, monitoring pair, desktop-download, cache HTTP), plus subscribeToTeamMessages (~50 lines, tracked separately in Hygiene). lib/jobs/service.ts maps five worker URLs (report, embedding, scheduled-report, export, cleanup) that have no route files — enqueue paths 404. Total maintainable surface that executes nothing useful: roughly 3,400–3,800 lines today, plus broken job types.

Fix risk: Bulk delete may remove bridge-invoked routes (internal autopull, desktop-download) — grep callers per file, not batch.

Fix effort: Roll-up cleanup pass — delete verified orphans in batches (lib exports, unwired routes, /produce) and implement or remove the five missing job workers.

Account shows weekly_digest and marketing_emails (~91–100). Grep under app/api/cron finds no digest or marketing cron. No UI path checks these prefs before sending — they only exist in lib/email/service.ts template mapping and the open /api/email/send relay allowlist. Users opt in/out of emails that are never sent.

Fix effort: Implement digest/marketing crons that respect prefs, or remove toggles from account UI.

Tracked public relay gap names inbound-relay, driver-chat and po-doc only. Sibling unauthenticated routes also lack withRateLimit: /api/public/window-appointments (POST spam + slot polling), /api/public/sales-relay (ODBC job enqueue), /api/public/will-call-print-request (print-queue flood), /api/public/invoice-status (live ODBC + relay), /api/public/shanetree-latest (full snapshot reads).

Fix effort: Add withRateLimit to window-appointments, sales-relay, will-call-print-request, invoice-status, shanetree-latest.

app/api/internal/willcall-print-claim/route.ts (~56–81) reads oldest pending will_call_print_requests row, then updates by id + status=pending. Two bridge processes can race; loser returns { row: null } with no retry signal. Unlike shanetree_relay_claim RPC, no FOR UPDATE SKIP LOCKED — duplicate print claims or missed jobs under concurrent bridge workers.

Fix risk: Atomic claim RPC changes double-print vs missed-print tradeoff on /noe kiosk.

Fix effort: Add claim_willcall_print_request RPC with FOR UPDATE SKIP LOCKED — mirror shanetree_relay_claim pattern.

app/port/page.tsx, app/noe/page.tsx and app/adrian/page.tsx each static-import EntreeClient with a mode prop (portMode, noeMode, adrianMode). Relay tablets on /port and sales kiosks on /noe download the same ~42k-line Shanetrée bundle as full /entree even though most modal tiles are hidden per mode. Route-level dynamic import or a thin mode shell would let each entry point ship a smaller first chunk.

Fix risk: EntreeClient monolith — kiosk and ERP panels share state; drive-by edits risk production dock workflows.

Fix effort: Route-level code splitting or thin mode shells that dynamic-import only the tiles each kiosk needs — must not break relay/print flows.

app/tools/greco/CindyVueClient.tsx (6,003 lines) statically imports parseXlsxAndBuildSchedule and export helpers from schedule-engine.ts (2,448 lines) and items logic from items-engine.ts (2,543 lines). Opening /cindyvue pulls ~11k lines of scheduling/parsing code into the first JS chunk. schedule-engine uses exceljs types at module scope; CindyVue also imports lib/supabase/tool-reports for firma photos and daily stats.

Fix risk: DockSheet receiving schedule is business-critical; lazy-loading or splitting can break 30s autosave and grid sync paths.

Fix effort: Dynamic-import schedule-engine on file upload; consider server-side parse API — CindyVue is operationally critical, needs dock-floor QA.

lib/lowslots/dakota-merge.ts (~11–17) documents a faithful port of inline EntreeClient parseDakotaSlotXlsx + mergeWithDakota that 'MUST stay in lockstep.' lib/lowslots/pick-list-xlsx.ts carries the same warning. Three copies (EntreeClient + two lib files) cannot import each other without refactoring the 42k-line monolith. Any Dakota column tweak must be applied thrice or /port relay and in-modal Low Slots diverge — unacceptable for enterprise sign-off.

Fix risk: Consolidating merge logic in lib/ must preserve EntreeClient modal behavior; wrong merge breaks slot counts operators trust for replen.

Fix effort: Extract parseDakotaSlotXlsx + mergeWithDakota into lib/lowslots/core.ts; EntreeClient imports it — pairs with Entree monolith split, high regression risk.

app/dashboard/page.tsx (~201–207, ~464–487) persists dashboard-theme in localStorage and toggles .dashboard-dark-mode on the dashboard root only (background #0f172a at ~1687). app/layout.tsx sets --page-bg on body but Account, Docs, Members and Greco tools use default light shells. Navigating from a dark dashboard to /account snaps to white — comment at ~466 explicitly says 'only this dashboard flips'. Site-wide theme would need layout-level class or next-themes.

Fix effort: Same site-wide theme vs WebKit trade-off.

app/dashboard/page.tsx is 3,496 lines — auth, Greco tool grid, email settings modals, team activity, documents, AI conversations, custom cards/tools, and admin tabs all live in one component. Only GodView is dynamic() (~63); everything else (including 20+ lib/supabase imports) loads on first dashboard visit. Extracting tab panels (Files, Team, Settings, Greco cards) behind dynamic() would shrink the default route chunk.

Fix risk: Tab lazy-load changes mount timing for 30s refresh, Greco grid, and settings modals — dashboard is the hub for every other route.

Fix effort: Extract tab panels behind dynamic() — touches auth bootstrap, Greco grid, and settings modals; multi-day refactor with dashboard regression testing.

EntreeClient's global Escape handler closes ~a dozen modals, but the effect's dependency array only lists three of those state values — the listener captures stale booleans, so Escape can no-op on a freshly-opened modal until an unrelated dep changes. The Drivers tool has a cousin bug: its requestAnimationFrame timer loop has no unmount cleanup.

Fix risk: Fixing deps in 41k-line EntreeClient — high regression risk; dedicated tested pass required.

Fix effort: Fix useEffect deps in 41k-line EntreeClient.tsx — high regression risk; needs dedicated tested pass.

app/forklift/page.tsx + lib/tools/processors/forklift.ts parse Day/Night BFC Task Summary xlsx into forklift_reports. No bridge endpoint, no join to Entrée SECID/employee master, no correlation with DockSheet QTYREC or /po-doc receiving lines. For enterprise ops, forklift TPH should eventually connect to what was received and what was still short — today it is an isolated leaderboard metric.

Fix effort: Join forklift_reports to DockSheet session_date + /po-doc QTYREC rollup — needs date/employee keys and optional ODBC pull on save.

toggleUserStatus in app/api/admin/godview/route.ts (~941–950) only updates profiles.is_disabled — inline comment admits 'would require auth admin API to actually disable users.' GodView 'disable user' does not block Supabase Auth login; flag is informational only unless something else reads it.

Fix risk: Wiring latent toggles suddenly enables or blocks behavior users assumed was active.

Fix effort: Call Supabase Auth admin ban API or hide toggle until profiles.is_disabled is enforced on login.

All Supabase client modules live in lib/supabase/*.ts at one depth — team-chat.ts, chat-rooms.ts, shanetree-snapshots.ts, member-permissions.ts, etc. No lib/supabase/chat/, reports/, greco/, or settings/ folders. Workable at current size but already hard to navigate; professional repos group by bounded context and co-locate types/tests per domain.

Fix effort: Split into lib/supabase/chat, reports, greco, settings with barrel re-exports — wide import path churn.

lib/supabase/tool-reports.ts holds save/get helpers for forklift, picker, shorts, skips, replen, returns, truck-errors, loader, reconciliation, daily stats, firma uploads, and notification hooks — 2,170 lines. Grep shows 15+ client pages static-importing it (picker, shorts, forklift, CindyVue, EntreeClient, drivers, daily-stats, etc.). Tree-shaking helps but type exports and shared upsertDailyStat still pull a large shared module into most Greco routes.

Fix risk: Large single-file page — extracting or refactoring risks breaking embedded business logic.

Fix effort: Split into per-tool modules (picker-reports.ts, shorts-reports.ts, etc.) or server actions — wide import graph across 15+ pages.

There is no middleware.ts. Every protected route checks supabase.auth.getUser() in a client useEffect and redirects after mount. RLS protects data, but unauthenticated visitors briefly render page shells and each page re-implements its own guard differently.

Fix risk: Central auth changes affect every protected route and public kiosk exception list.

Fix effort: Add middleware.ts with Supabase session cookie check + redirect — touches every protected route's guard logic; high regression surface.

lib/realtime/broadcast.ts (~49–54) builds broadcast:${scope}:${resourceId} from predictable inputs. Any logged-in Supabase client knowing a document UUID can subscribe and send cursor, typing, content_diff, selection and scene_action events. No server-side channel ACL — collaboration spoofing on shared docs is possible if IDs leak.

Fix risk: Realtime filter changes alter what live updates appear — easy to hide needed events.

Fix effort: Supabase Realtime channel auth or server-minted channel tokens — requires RLS on realtime.messages or custom auth hook.

app/returns/page.tsx categorizes BFC export columns (Item, Rtn Cd, Customer Name, Orig. Inv#). Window Returns modal pulls live artrans/arytran QTYSHP<0 via ODBC (shanetree-whitepaper.ts ~58, ~84). No tool compares Returns+ categorized output against Entrée ODBC returns the way Return Diffs does for credit memos — another BFC-vs-ERP gap where only one side got the three-way diff treatment.

Fix effort: New diff modal or extend Return Diffs to compare Returns+ categories vs ODBC QTYSHP<0 — similar snapshot pattern to return_diffs_snapshots.

app/layout.tsx sets html style colorScheme:'light' plus meta tags; app/globals.css lines 6–8 force color-scheme: light !important. This is intentional for WebKit gradient fixes but means dashboard's dark-mode toggle (localStorage dashboard-theme) can't propagate — leaving /dashboard snaps every other page back to forced light.

Fix effort: Site-wide theme requires reconciling WebKit gradient fix (globals.css !important) with dashboard dark mode — architectural CSS conflict.

Debounced autosave in RoutingClient.tsx (~1130–1140) POSTs the entire stops array after every edit. POST /api/routing/routes upserts greco_routes by id with no version column or optimistic lock (routes/route.ts ~80–102). Two dispatcher tabs editing the same route overwrite each other's stop order — parallel to tracked DockSheet session autosave but greco_routes is not named there.

Fix effort: Add updated_at optimistic lock or merge strategy on greco_routes POST.

app/schedule-outlook/ScheduleOutlookClient.tsx (2,278 lines) comments at ~72 and ~298 say logic was 'copied verbatim' from app/tools/greco/lib/schedule-engine.ts. Bug fixes and performance tweaks must be applied twice; bundle weight doubles for anyone who uses both DockSheet and the Outlook binder. Extracting a shared @/lib/greco/schedule-core module is the fix — moderate refactor with regression risk on colored exports.

Fix risk: Deduping into shared module must update DockSheet colored exports and Outlook binder in lockstep — bugfix currently applied twice for a reason.

Fix effort: Extract shared schedule-core module used by both CindyVue and Outlook — must verify colored exports and combine-by-load parity on real xlsx files.

tool-reports, shanetree-snapshots, shanetree-pull-log, shanetree-print-log, shanetree-manual-subs, account-geocodes and shanetree-relay each re-implement profile lookup + fallback + profile repair, and they've drifted (relay skips profile repair; company-settings returns null with no fallback).

Fix risk: Fixing one resolver without the other six reintroduces drift; relay skips profile repair, company-settings returns null — behaviors differ intentionally today.

Fix effort: Extract shared resolveCompanyId() in lib/supabase/ and replace 7 implementations — wide diff, each tool path needs smoke test.

tool-reports, shanetree-snapshots, shanetree-pull-log, shanetree-print-log, shanetree-manual-subs, account-geocodes and shanetree-relay each re-implement profile lookup + fallback + profile repair, and they've already drifted (relay skips profile repair; company-settings returns null with no fallback). Beyond the known Greco auto-assign problem, the duplication itself means any fix has to land seven times. One shared resolveCompanyId() is overdue.

Fix risk: Duplicate audit title — same seven-way resolver drift risk.

Fix effort: Same shared helper extraction.

shanetree-whitepaper.ts §5.19: Subs export pulls prior-day DockSheet session POs and live /po-doc QTYREC per PURNO to flag whether receipts cover next-day OOS demand (EntreeClient.tsx ~12637, ~13189, ~13779). This is meaningful WMS(scheduler)+ERP(receiving) intimacy. Standalone Replen, Negative Slots, Loader and Thruput never consume greco_cindyvue_sessions or /po-doc — the join logic lives only inside one Shanetrée modal instead of a reusable lib/greco/receiving-bridge module.

Fix risk: Extracting receiving-bridge from EntreeClient modal risks breaking Subs export that flags OOS vs receipts.

Fix effort: Extract lib/greco/receiving-bridge.ts from Subs modal; wire Replen/Transfers/Loader to greco_cindyvue_sessions + /po-doc QTYREC.

exceljs and xlsx are both installed for the same job (see previous item); recharts powers ~14 pages while ten @nivo/* packages exist solely for AgentGenerativeUI; html2canvas and html-to-image each serve one DOM-to-image call site. Every pair is duplicated bundle weight and divergent behavior. Also, @types/leaflet sits in dependencies instead of devDependencies.

Fix risk: Spreadsheet parser changes affect every upload tool — cell types and dates may shift.

Fix effort: Dependency consolidation: drop xlsx OR exceljs, drop html2canvas OR html-to-image, audit nivo usage — wide bundle impact.

wc -l: app/entree/EntreeClient.tsx ~41,917; app/tools/greco/CindyVueClient.tsx ~6,076; app/shorts/page.tsx ~4,327; app/dashboard/page.tsx ~3,496. Loader unification and back-navigation had to tip-toe around them. Any cross-cutting UI change (shared modal, a11y, error banner) risks merge conflicts — gradual panel extraction lowers blast radius.

Fix risk: Same monolith blast radius — cross-cutting UI in 41k-line EntreeClient is not a safe drive-by fix.

Fix effort: Gradual panel extraction from EntreeClient/CindyVue — weeks of careful work, not one PR.

wc -l: app/entree/EntreeClient.tsx ~41,917; app/tools/greco/CindyVueClient.tsx ~6,076; app/shorts/page.tsx ~4,327; app/dashboard/page.tsx ~3,496. Loader unification and back-navigation pass tip-toed around these — any cross-cutting UI change (shared modal, a11y, error banner) risks merge conflicts across tens of thousands of lines. Gradual panel extraction lowers blast radius.

Fix risk: Any extraction from EntreeClient/CindyVueClient/shorts/dashboard risks breaking dock-floor panels that share local state — loader pass deliberately avoided these.

Fix effort: Same long-term decomposition.

greco_cindyvue_sessions stores list_data + grid_data + history_log JSONB per dock day; shanetree_snapshots holds full ODBC modal payloads; quote_submissions.file_attachments embeds base64 in JSONB (app/quote/page.tsx); picker_reports.raw_input_data and report JSONB columns grow unbounded. lib/supabase/user-files.ts correctly uses Storage — these older tables bypass object storage and will dominate backup size and query latency.

Fix effort: Migrate dock sessions, snapshots, quote attachments to Supabase Storage — large data migration, URL rewiring, backward compat.

NEXT_PUBLIC_GRECO_COMPANY_ID is load-bearing in ~15 places: GrecoOnlyGuard on every warehouse tool, the session/driver-chat/will-call/item-alert public APIs, unified history's dock-event merge, and dashboard card logic. Plus greco_-prefixed tables (greco_daily_stats, greco_routes, greco_card_permissions) and name-matching on 'greco'. Fine as long as FileDisplay serves one warehouse operator — but it's the single biggest refactor standing between this codebase and a second customer, and worth a deliberate decision rather than gradual accretion.

Fix risk: Removing GRECO_COMPANY_ID hardcode requires threading real tenant context through 29 tools, kiosks, and public APIs — partial migration breaks Greco-only routes for everyone.

Fix effort: Multi-warehouse onboarding refactor — company-scoped tables, remove greco_ prefix pattern, ~15+ env references.

greco_cindyvue_sessions has no company_id column. POST app/api/greco/session/route.ts (~176–186) upserts on onConflict: 'session_date' only — list_data/grid_data/history_log keyed globally per calendar day. Writer check (~155–160) verifies profile.company_id === GRECO_COMPANY_ID env UUID, not per-row tenant. DockSheet, /live/greco, /timer and /inbound share one global session row per date — second warehouse impossible without schema change.

Fix risk: Adding company_id + RLS touches DockSheet, /live/greco, /timer, /inbound, CindyVueClient autosave, and every onConflict: session_date upsert — second warehouse is a schema migration plus full stack retest.

Fix effort: Add company_id + RLS to greco_cindyvue_sessions and thread through entire DockSheet/live/timer stack — prerequisite for second warehouse customer.

Lines 145–153 describe NEXT_PUBLIC_TURN_* for WebRTC relay. Pass 7 noted the calls table has zero app queries; complementary angle: env docs promise video-call infrastructure (calendar call_type column too) that was scaffolded in migrations and never integrated. Operators configuring TURN are wiring a feature that does not exist.

Fix effort: Remove TURN block from .env.example or add '# future — not implemented' banner.

app/api/ai/models/route.ts GET (~4–7) has no session, API key, or withRateLimit. discoverAllowedAIModels() in lib/ai/model-discovery.ts (~19) fetches https://ai-gateway.vercel.sh/v1/models on cache miss. Public internet can invoke model catalog discovery and trigger outbound gateway requests — exposes available models and may consume origin rate quota.

Fix effort: Require session or withRateLimit; cache response server-side only.

app/api/health/ready/route.ts and app/api/health/live/route.ts implement standard k8s-style probes, but grep finds zero fetch, docs link, vercel.json reference, or script calling health/ready or health/live. Main /api/health is referenced in problems and ArchitectureDiagram; these two sub-routes may exist only for external infra that was never configured — ~40 lines of unmaintained probe surface.

Fix effort: Wire into vercel.json/k8s probes or delete routes if infra never adopted.

app/api/routing/routes/route.ts authenticates via Bearer token but grep finds zero withRateLimit calls. GET/POST can hammer greco_routes full stops JSONB reads/writes without throttling — unlike most app/api/* routes. Route-planning spam could stress Postgres and the Entrée bridge when AI-build is chained.

Fix effort: Add withRateLimit to routing/routes GET and POST — config-only pattern.

app/phl/page.tsx is a Permawrite-license landing page with no dashboard card, greco-tools entry or nav link. Grep href='/phl' in app/ finds only docs/page.tsx and ArchitectureDiagram.tsx. ~405 lines maintained with no operational entry point.

Fix effort: Delete page or add footer/docs-only nav; avoid maintaining unreachable route.

app/account/page.tsx settings tab strip uses overflow-x-auto with -mx-4 px-4 (~849) but no fade gradient or scroll affordance (contrast dashboard tab bar which has a sm:hidden right gradient at ~1765). Users on small phones may not realize Notification / Security / API tabs continue off-screen.

Fix effort: Copy dashboard tab-bar right-edge gradient or add scroll-snap + chevron affordance.

lib/supabase/port-summary-memory.ts addPortSummaryMemory() (~30 lines) has zero callers — production uses addPortSummaryMemoryBulk via lib/ai/port-summary-persist.ts. lib/rate-limit.ts cleanupRateLimitLogs() (~10 lines) is exported but no cron or route calls it despite cleanup_rate_limit_logs RPC existing in migrations.

Fix effort: Delete singular addPortSummaryMemory; schedule cleanupRateLimitLogs in memory-cleanup cron.

AGENTS.md line 43 warns about vscode-fork/ lint errors — git ls-files finds no such directory. README.md (~70–72) documents yarn dev and pnpm dev in an npm-only repo (package-lock.json). Stale guidance sends agents and contributors hunting for ghosts.

Fix effort: Edit AGENTS.md + README — docs only.

AGENTS.md line 43 warns agents about lint errors from vscode-fork/ — glob finds zero such directory in checkout (git ls-files vscode-fork returns empty). README.md Getting Started (~70–72) still documents yarn dev and pnpm dev while package-lock.json and .cursorrules specify npm only. Stale onboarding sends every new contributor/agent on a ghost hunt.

Fix effort: Edit AGENTS.md + README — docs only.

app/entree/BridgeRelayPanel.tsx (~414–437) adaptive poll loop has no document.hidden check (unlike PortAISummaryPanel.tsx ~292–297). Leaving the relay panel open on a dock PC sustains shanetree_relay_requests reads all shift — compounds tracked aggressive polling on kiosk screens.

Fix risk: Slowing poll delays print relay on Shanetrée — autoprint workflow is time-sensitive.

Fix effort: Skip poll tick when document.hidden — BridgeRelayPanel.tsx, match PortAISummaryPanel.

git ls-files includes build-output.txt (~8.5 KB) at repo root — captured Windows PowerShell output from a failed next build on EntreeClient.tsx:9454 (duplicate customerOpen useState, Turbopack error). .gitignore covers /build.log but not build-output.txt. Stale failure log from a since-fixed compile error; should be deleted and pattern added to .gitignore.

Fix effort: Delete file + gitignore pattern.

Month grid event chips render start times with hidden sm:inline (~734) — below sm breakpoint users see colored title text only, no time-of-day. Scheduling at a glance on a phone requires opening the day panel or expanded overlay for every event.

Fix effort: Show abbreviated times on xs (e.g. 9a) or always show time in chip tooltip/title.

lib/supabase/ai-chat-sessions.ts:366 exports canJoinSession() for capacity guarding. app/chat/page.tsx uses joinChatSession() directly with no prior canJoinSession check. ~25 lines of session-capacity logic that never gates joins — users can exceed intended session limits silently.

Fix effort: Call canJoinSession before joinChatSession in chat/page.tsx or remove export.

app/components/collaboration/TypingIndicator.tsx (~30–41) renders animated 'X is typing…' with no role='status' or aria-live='polite'. Used in app/documents/page.tsx, app/chat/page.tsx and app/team-chat/page.tsx — screen readers won't announce remote typing during collaborative editing.

Fix effort: Add role='status' aria-live='polite' to TypingIndicator.tsx.

app/controls/ControlsClient.tsx sidebar section buttons hide blurb text with hidden lg:block (~203). Tablet-width admins (md–lg) see icon + title only — nine sections (Users, Tools, Cards, AI, Email, Integrations…) look like a dense icon list with no context for what each controls.

Fix effort: Show blurbs from md breakpoint (hidden md:block) or tooltip on hover/focus for section buttons.

app/developer/page.tsx (~108–110) reads searchParams once into useState(initialTab) with no useEffect to sync URL changes. In-app navigation to /developer?tab=webhooks from an already-mounted page won't switch tabs — API Keys stays active.

Fix effort: useEffect sync activeTab from searchParams when tab param changes.

lib/greco/greco-tools.ts GRECO_TOOLS entries at lines 80–81: Driver Chat (/inbox) and Throughput Tracker (/thruput) both set color: 'from-emerald-500 to-teal-600' — same emerald-to-teal Tailwind gradient on adjacent tool-grid cards. Dashboard/minimal layouts use gradient as primary identifier; operators can't tell logistics chat from analytics at a glance without reading labels.

Fix effort: Change color string on one card in greco-tools.ts.

lib/greco/greco-tools.ts GRECO_TOOLS reuses SVG path d strings: Forklift Productivity (line 62) and Throughput Tracker (line 81) both use lightning bolt M13 10V3L4 14h7v7l9-11h-7z; Weekly Returns (line 74) and Cycle Count (line 68) share the same bar-chart icon M9 19v-6a2 2 0 00-2-2H5…; Shorts (line 64) and Damages (line 75) share the warning-triangle path. In compact/minimal dashboard layouts icon is the primary discriminator — duplicates slow floor recognition.

Fix risk: Deduping parallel implementations must update every copy or behavior drifts again.

Fix effort: Same icon path updates.

app/empty-slots/page.tsx calls logReportGeneration + notifyReportGenerated (~507–508) but never upsertDailyStat. app/daily-stats/DailyStatsClient.tsx TOOL_META has no empty_slots key (unlike driver_scan). Daily Stats grid and greco-digest cron stay blind to Empty Slots runs despite being a tracked Greco tool.

Fix effort: Call upsertDailyStat on save + add empty_slots to DailyStatsClient TOOL_META.

app/tools/greco/lib/excel-exports.ts:29 exports exportTrackerWorkbook(). CindyVueClient imports sibling exports (exportCombinedWorkbook, exportFenceReport, etc.) but grep finds zero references to exportTrackerWorkbook — ~80 lines of tracker-specific ExcelJS workbook builder that no UI path triggers.

Fix effort: Delete exportTrackerWorkbook from excel-exports.ts or add CindyVue export button.

app/components/FancyLoader.tsx has no role='status', aria-busy, or aria-live. Used site-wide for auth and data loading gates — assistive-tech users get no 'loading' announcement while sitting on a blank or spinning screen.

Fix effort: Add role='status' aria-live='polite' and visually hidden 'Loading' text to FancyLoader.tsx.

lib/tools/processor.ts:46 and lib/tools/processors/base.ts:8 each export interface FileInput with the same shape. Processors import from base.ts; processor.ts re-declares the type for its own ProcessRequest. Minor drift risk (~20 lines duplicate) atop the already-tracked dead lib/tools/index.ts barrel.

Fix risk: Deduping parallel implementations must update every copy or behavior drifts again.

Fix effort: Import FileInput from processors/base.ts in processor.ts; delete local duplicate.

app/layout.tsx (~58–60) renders AdminFooterLink on every page. app/components/AdminFooterLink.tsx uses text-slate-400 text-[9px] on all routes. Greco warehouse tools (forklift, shorts, entree) and dashboard dark mode use #0f172a backgrounds — slate-400 on slate-900 fails WCAG contrast (~2.5:1). Footer reads as a stray artifact on dark tool pages rather than intentional subtle branding.

Fix effort: Dark-route-aware footer text class via PageBgSync or route-chrome helper.

lib/supabase/quote-submissions.ts getAllQuoteSubmissions() (~30 lines) has zero callers — admin dashboard loads submissions via /api/admin/submissions inline. lib/supabase/chat-rooms.ts deleteChatRoom() (~25 lines) is exported but team-chat never deletes rooms. Two small orphans that suggest unfinished admin/chat management flows.

Fix effort: Delete exports or add admin UI that uses them.

lib/supabase/member-permissions.ts:133 exports getMemberPermissions(userId). app/account/page.tsx:15 imports it alongside getAllMemberPermissions / updateMemberPermissions, but grep getMemberPermissions( finds zero call sites — dead import plus dead export. Account admin panel loads all members via getAllMemberPermissions only.

Fix risk: Wiring latent toggles suddenly enables or blocks behavior users assumed was active.

Fix effort: Drop unused import from account/page.tsx; delete or keep export only if admin API needs it later.

lib/supabase/team-chat.ts:334 exports async getUnreadMentionCount() querying chat_mentions with .eq('mentioned_user_id', user.id) — zero grep importers. Dashboard header and account page use getMyUnreadMentionCount (~line 310) with room-scoped logic. Dead ~25-line duplicate; deleting export won't break any caller.

Fix effort: Delete export or redirect to getMyUnreadMentionCount.

lib/supabase/calendar.ts:121 exports getUpcomingEvents(days, limit). app/calendar/page.tsx:13 imports it but grep getUpcomingEvents( finds zero call sites — page loads full events via getCalendarEvents only. Dead import on the page plus ~35 lines of unused 'next N days' query logic.

Fix effort: Remove import from calendar/page.tsx; delete export or use in dashboard sidebar widget.

dashboard/page.tsx (~454, ~487) and account/page.tsx (~199, ~213) read/write hiddenDashboardCards with no user suffix. On a shared warehouse PC one operator hiding Overview cards affects the next login on the same browser profile.

Fix risk: Per-user suffix resets card layout for shared dashboard login — operators may lose custom grid.

Fix effort: Namespace key with userId like homepage-bg-theme should be.

app/page.tsx (~359–370): useEffect reads/writes localStorage key 'homepage-bg-theme' globally — no auth.uid() or company_id suffix. Contrast lib/i18n/context.tsx greco-lang-pref and WindowClient window-theme keys namespaced per context. Shared dock PC: operator A picks 'midnight' gradient; operator B on / landing inherits A's choice before login.

Fix effort: Suffix key with userId once session known in app/page.tsx.

app/api/public/item-alert-subscribe/route.ts (~107) sets data.sessionDate to new Date().toISOString().slice(0, 10) in the Resend confirmation template. Subscribers near the Eastern midnight boundary see tomorrow's date in the 'you're subscribed' email while the warehouse floor still considers it today.

Fix risk: Date boundary changes reorder stats, leaderboards, and filters keyed on existing date columns.

Fix effort: Use warehouse-local date in item-alert-subscribe confirmation template data.

app/api/public/item-alert-subscribe/route.ts line 100 sends template:'item_scheduled' with actionLabel:'Subscription Confirmed' — a truck-scheduled template, not a dedicated subscribe confirmation. Misleading subject/body for new item-alert subscribers. Separate from tracked UTC sessionDate in the same route.

Fix effort: Add dedicated item_alert_subscribed template in lib/email/service.ts.

Migration 094 removed Smart Reports, but lib/supabase/leaderboard.ts still assigns 8 points to smart_report_api_generated and smart_report_recipe_generated and includes them in the Reports bucket filter. No new events can arrive — the scoring rules are dead weight that mislead anyone tuning leaderboard weights. Related HistoryLedger styling is tracked separately in Hygiene; this is the useless gamification half.

Fix effort: Remove smart_report_* from POINT_VALUES and Reports bucket in leaderboard.ts.

lib/notifications/trigger.ts console.log('[TRIGGER] Data:', JSON.stringify(data)) (~31) on every notification. Report filenames, mention contexts and member metadata appear in DevTools on shared warehouse machines. Picker notifyReportGenerated console dump is tracked separately — this is the shared module every Greco tool calls.

Fix effort: Remove or gate console.log behind NODE_ENV — strip from production bundle.

The ~74-line re-export barrel documents importing from '@/lib/tools', but grep finds no live imports of that path — callers import lib/tools/registry, processor and detector directly. Barrel also re-exports getProcessableTools(), validateToolMatch() and getAvailableProcessors(), which are themselves uncalled (~40 lines across registry/processor/detector).

Fix effort: Delete barrel file and unused getProcessableTools/validateToolMatch/getAvailableProcessors exports.

app/login/page.tsx mount useEffect (~20–35) only reads ?redirect= param and fd_remembered_email from localStorage — no supabase.auth.getSession() or getUser() check. Logged-in users visiting /login see the full sign-in form until they submit credentials again. Contrast signup/reset-password patterns; missing middleware.ts would also catch this centrally.

Fix risk: Auto-redirect to dashboard can loop with ?redirect= open-redirect fixes or break kiosk landing on /login.

Fix effort: getSession() on mount → router.replace(redirect || '/dashboard').

Panel-scale loaders (analytics tabs, chat panels, settings modals…) were unified onto the fancy loader, but tiny in-button spinners (Save, Add, Generating…) keep their small border-spinner style — a 3-ring loader isn't legible at 12–16px. They're consistent within their contexts but not identical across pages. Acceptable, noted for completeness.

Fix effort: Acceptable as-is; optional unified micro-spinner component.

app/api/monitoring/alerts/route.ts (~172–177) selects all webhook_deliveries with success=false in the last 24h with no .limit(). High-volume tenants with flaky webhook endpoints can return thousands of failure IDs per founder poll — compounds unbounded metrics collectors above.

Fix risk: Adding caps breaks export or load-all flows that depend on fetching entire tables.

Fix effort: Add .limit(100) on webhook_deliveries failure select in monitoring/alerts/route.ts.

app/api/monitoring/metrics/route.ts (~87–88) and monitoring/alerts/route.ts gate on role === 'admin' || role === 'founder' only. Unlike app/api/admin/members/route.ts (~57–59), they omit is_founder. A user with is_founder: true and role: 'editor' is denied /monitoring despite being a founder — inconsistent with GodView and admin member routes.

Fix effort: Add is_founder check to monitoring/metrics and alerts routes — match admin/members pattern.

job-retries, stale-jobs, greco-digest, webhooks, agent-autonomy, memory-cleanup and activity-log-cleanup export public GET returning { status: 'ok', endpoint: '...' } without CRON_SECRET check. Confirms internal route names and schedules to unauthenticated scanners (greco-digest also leaks retention_days).

Fix effort: Return 401 on GET unless CRON_SECRET header present — ~7 cron route files.

package.json lists ai ^6.0.86 and @ai-sdk/openai ^3.0.29. Grep from 'ai' and from '@ai-sdk' across *.ts/tsx finds zero imports — all live AI paths use @/lib/ai/gateway, geminiFetch, and direct fetch to Google APIs. Two unused SDK dependencies adding install weight and audit surface.

Fix effort: npm uninstall ai @ai-sdk/openai if no planned Vercel AI SDK migration.

lib/greco/greco-tools.ts:69 registers { name: "Juan's Counting Tool", shortName: "Juan's Tool", route: '/counting' } in GRECO_TOOLS. Appears on dashboard tool grid, Controls greco_card_permissions matrix (keyed by /counting), and lib/i18n strings. Production tool title tied to one person — ages poorly as teams change; functional name + subtitle credit is safer.

Fix effort: Rename Juan's Tool card in greco-tools.ts.

app/picker/page.tsx (~1233–1246): after notifyReportGenerated(), console.log('[PICKER] Starting email notification...'), console.log('Notification result:', JSON.stringify(notifyResult, null, 2)) dumps member emails and send counts. Shared warehouse PCs with devtools open leak notification metadata — should use structured logger behind NODE_ENV or remove.

Fix effort: Remove console.log in app/picker/page.tsx after notifyReportGenerated.

git tracks public/next.svg and public/vercel.svg alongside logo.png, deltamorph-icon.png and warehouse photography. Boilerplate assets signal an unpolished deploy to anyone inspecting static files. Delete unused SVGs; add public/README.md listing intentional brand files only.

Fix effort: Delete next.svg and vercel.svg if unused; grep public/ references first.

stats useMemo in app/entree/PullLogPanel.tsx (~323) compares created_at.slice(0,10) to new Date().toISOString().slice(0,10) for the 'today' HUD counter. Evening ODBC pulls count toward tomorrow's bucket — subset of Entree UTC date issues but the Pull Log operator HUD is not called out in pass 10.

Fix risk: Date boundary changes reorder stats, leaderboards, and filters keyed on existing date columns.

Fix effort: Compare against warehouse-local today string in PullLogPanel stats useMemo.

app/quote/page.tsx renders the full project-request form (title, description, file upload) for every role. canSubmit gates only the submit button and shows a 'Viewers cannot submit' banner at the bottom (~238–252). Viewers can spend time filling fields and attaching files before discovering submission is blocked — should disable inputs or show the restriction at the top.

Fix effort: Disable inputs when !canSubmit or show view-only banner above the form on mount.

lib/rate-limit.ts reads RATE_LIMIT_FAIL_CLOSED (fail-open on RPC errors unless 'true'). Referenced in problems copy but missing from .env.example — prod deploys won't know the knob exists. Earlier env-var audit marked fixed but this one was left out.

Fix effort: Add one line to .env.example documenting fail-closed rate limiting.

lib/supabase/shanetree-relay.ts lines 68 and 75 both list { value: '/subs', … } with different labels ('Subs' vs 'Subs (OOS + Demand)'). ALL_RELAY_ENDPOINTS dedupes via Set so runtime is fine, but the ODBC relay allowlist UI can show duplicate /subs entries and signals copy-paste drift in the bridge relay registry.

Fix effort: Remove duplicate /subs entry; consolidate labels in shanetree-relay.ts.