From d03ef2db50f0f245b94f432132167f41d2d09f2f Mon Sep 17 00:00:00 2001
From: sdarbinyan <sdarbinyan@4pay.ru>
Date: Sun, 26 Jul 2026 12:35:26 +0400
Subject: [PATCH] docs: final project closeout - classify TODO, backend spec,
 status

Classified every TODO.md item into one of DONE/BACKEND/PRODUCT
DECISION/FUTURE VERSION/BUG, verified against source, not against
prior docs:

- BACKEND items (bootstrap content, builder draft/publish, 6 admin
  CRUD domains, media pipeline) confirmed already covered by
  BACKEND_INTEGRATION.md; appended a mapping appendix rather than
  duplicating raw bullets. Fixed 22 stale internal BACKEND_API.md
  cross-references left over from before that file was archived.
- PRODUCT DECISION items (dark mode, brand-color WCAG contrast,
  stars.component token gap, footer Contacts content, advanced
  analytics, payment providers) moved to new docs/PRODUCT_BACKLOG.md.
- FUTURE VERSION items (Angular 22, bundle splitting, cart-modal
  composition cleanup, hero-spacing investigation) moved to new
  docs/FUTURE_FEATURES.md.
- BUG: rewrote docs/KNOWN-ISSUES.md down to the one real, verified,
  currently-reproducible frontend bug (Ed25519 admin-auth error codes
  session-expired/invalid-signature are unreachable -
  toAuthErrorShape() never reads a body error code, only maps HTTP
  status, and no status ever produces those two codes - confirmed by
  reading auth.service.ts + auth-error.model.ts). Condensed the
  "Fixed" history instead of carrying full verbose repro text forward.
- DONE items removed outright (dead-code deletion, dashboard false
  positive, RC-02 fixes, stale "dynamic-renderer unwired"/"178 missing
  keys" claims already disproven by source).

docs/TODO.md rewritten to the exact "no blockers" template - nothing
left qualifies as a release blocker.

New docs/PROJECT_STATUS.md: honest per-area status (frontend/backend/
docs/auth/builder/storefront/admin), known limitations, and explicit
production/backend/demo readiness calls - including correcting an
initial draft's unpushed-commit count (53, not 10, per git log
origin/B2B..HEAD).

New docs/NEXT_PHASE.md: work that can only start once a real backend
exists (gateway swap-in, mock removal, dormant-auth activation, role
enforcement, integration/E2E tests, perf profiling, monitoring,
maintenance-mode UI).

docs/PROJECT_INDEX.md (the stated entry point) updated to link the new
doc set and stop pointing at the now-archived BACKEND_API.md/AUTH.md.
docs/FRONTEND-ROADMAP.md's "Known open items" replaced with pointers
to the new category-split docs instead of a duplicated mixed list.

Not swept: a handful of low-traffic docs (architecture ADRs,
FRONTEND.md, EDITOR.md, ARCHITECTURE.md, PROJECT-STRUCTURE.md,
StaticPages.md, ADMIN.md) still reference the old BACKEND_API.md/
AUTH.md filenames - noted as a known gap in PROJECT_STATUS.md rather
than touched blindly, since they're historical-context docs, not the
navigation entry point.
---
 docs/BACKEND_INTEGRATION.md |  66 ++++--
 docs/FRONTEND-ROADMAP.md    |  23 +--
 docs/FUTURE_FEATURES.md     |  19 ++
 docs/KNOWN-ISSUES.md        | 395 ++++--------------------------------
 docs/NEXT_PHASE.md          |  39 ++++
 docs/PRODUCT_BACKLOG.md     |  39 ++++
 docs/PROJECT_INDEX.md       |  24 ++-
 docs/PROJECT_STATUS.md      |  52 +++++
 docs/TODO.md                |  52 +----
 9 files changed, 253 insertions(+), 456 deletions(-)
 create mode 100644 docs/FUTURE_FEATURES.md
 create mode 100644 docs/NEXT_PHASE.md
 create mode 100644 docs/PRODUCT_BACKLOG.md
 create mode 100644 docs/PROJECT_STATUS.md

diff --git a/docs/BACKEND_INTEGRATION.md b/docs/BACKEND_INTEGRATION.md
index 222a5f9..b14f506 100644
--- a/docs/BACKEND_INTEGRATION.md
+++ b/docs/BACKEND_INTEGRATION.md
@@ -1,6 +1,6 @@
 # Backend Integration — Canonical Specification
 
-**This is the single source of truth for backend implementation.** It supersedes and merges `docs/BACKEND_API.md`, `docs/AUTH.md`, `docs/ADMIN.md`, and `docs/BACKEND_API_REMAINING_WORK.md` (all archived — see `docs/archive/` and the note at the end of this file). It incorporates `docs/AUTHENTICATION.md` (§4) and `docs/ERROR_CONTRACT.md` (§6) in full; those files remain in place as standalone references but this document is authoritative. `docs/MAINTENANCE_MODE.md` is a companion doc, referenced from §6.
+**This is the single source of truth for backend implementation.** It supersedes and merges `docs/archive/BACKEND_API.md`, `docs/AUTH.md`, `docs/ADMIN.md`, and `docs/BACKEND_API_REMAINING_WORK.md` (all archived — see `docs/archive/` and the note at the end of this file). It incorporates `docs/AUTHENTICATION.md` (§4) and `docs/ERROR_CONTRACT.md` (§6) in full; those files remain in place as standalone references but this document is authoritative. `docs/MAINTENANCE_MODE.md` is a companion doc, referenced from §6.
 
 Everything here is derived from the actual current frontend source code (branch `B2B`), not from prior/stale documentation. Primary input: `docs/context/BACKEND-AUDIT.md` (exhaustive audit of every HTTP call, gateway, facade, and model in the frontend).
 
@@ -34,7 +34,7 @@ Source of truth for this section:
 `src/app/core/config/tenant-resolver.service.ts`,
 `src/app/shared/models/config/*`, and the mock document
 `src/assets/mock/bootstrap/bootstrap.json`. Cross-referenced against
-`docs/context/BACKEND-AUDIT.md` §6, §2 and the prior `docs/BACKEND_API.md`.
+`docs/context/BACKEND-AUDIT.md` §6, §2 and the prior `docs/archive/BACKEND_API.md`.
 
 ### 1.1 Request contract
 
@@ -999,7 +999,7 @@ Example response:
 Exhaustive per-domain, per-endpoint contract for every backend touch-point the
 Angular frontend expects. Derived from source on branch `B2B` and cross-checked
 against `docs/context/BACKEND-AUDIT.md` (the this-session audit — the ground
-truth for what code actually does), the prior `docs/BACKEND_API.md`, and the two
+truth for what code actually does), the prior `docs/archive/BACKEND_API.md`, and the two
 sibling specs written this session:
 
 - **Auth / headers / JWT** — see `docs/AUTHENTICATION.md`. This section never
@@ -4180,7 +4180,7 @@ Frontend view model: `AdminOrder` + `AdminOrderCustomer`, `AdminOrderPayment`,
 Bridge: **a new `AdminOrdersApiGateway` must contain the mapping** JSON → `AdminOrder`, honoring
 the `AdminOrdersGateway` interface methods (`loadOrders`, `loadOrder`, `updateStatus`,
 `requestRefund`, `addNote`, `archiveOrder`, `restoreOrder`, `deleteOrder`). The `status` field
-must respect the order state machine (see the Orders CRUD contract / BACKEND_API.md §8.1).
+must respect the order state machine (see the Orders CRUD contract / archive/BACKEND_API.md §8.1).
 The same "no mapper exists, write one inside the new `*ApiGateway`" note applies to Products,
 Users, Transactions, Monitoring, and Moderation.
 
@@ -4292,14 +4292,14 @@ L on the server.
 
 A literal, top-to-bottom checklist. Work the phases in order; within a phase, items are roughly
 independent. Section references point to the assembled backend-integration document (this doc's
-§8, the CRUD-contracts sections, and `docs/BACKEND_API.md` where a full shape already lives).
+§8, the CRUD-contracts sections, and `docs/archive/BACKEND_API.md` where a full shape already lives).
 
 ### Phase 1 — Foundation (nothing role-gated works until these land)
 
-- [ ] Implement session issuance/check/logout: `POST /users/sessions`, `GET /users/sessions/:id`, `DELETE /users/sessions/:id` — per Auth contract (§5a; BACKEND_API.md `/users/sessions/*`, already client-LIVE).
+- [ ] Implement session issuance/check/logout: `POST /users/sessions`, `GET /users/sessions/:id`, `DELETE /users/sessions/:id` — per Auth contract (§5a; archive/BACKEND_API.md `/users/sessions/*`, already client-LIVE).
 - [ ] Implement the Ed25519 admin-auth flow `GET /api/admin/auth/challenge`, `POST /verify`, `POST /refresh`, `POST /logout` — client wiring is LIVE and 404s today (§5b). Return `AuthChallenge` / `AuthTokenPair` shapes exactly.
 - [ ] Honor the admin auth headers on every gated path: `AdminWebSessionID` + `Authorization: Bearer` for URLs containing `/admin/`, `/backoffice/`, `/builder/`, `/media/` (§3 interceptor pipeline).
-- [ ] Serve real `GET /bootstrap` **content** (branding, theme, navigation, seo — not just the transport) — per Bootstrap contract (§6; BACKEND_API.md §4). This is a P0 blocker.
+- [ ] Serve real `GET /bootstrap` **content** (branding, theme, navigation, seo — not just the transport) — per Bootstrap contract (§6; archive/BACKEND_API.md §4). This is a P0 blocker.
 - [ ] Populate `bootstrap.apiEndpoints.{website,builder,backoffice}` records so tenant-scoped paths resolve at runtime (§6; audit §24 — no path literals exist in client code).
 - [ ] Confirm tenant resolution inputs (host/slug/code) match `TenantConfig` so `ApiConfigService.getBaseUrl()` resolves the right base (§2, §6).
 - [ ] Adopt a consistent error envelope; the client maps failures to a `backend-unavailable` screen for admin auth — keep error bodies non-leaky (§5b; security guidance).
@@ -4309,34 +4309,34 @@ independent. Section references point to the assembled backend-integration docum
 
 - [ ] Stand up `GET /category` returning the `CategoryDto` shape `CategoryMapper` tolerates (§8.4 Example A; audit §8) — already LIVE client-side.
 - [ ] Stand up `GET /items/:id`, `GET /category/:id`, `GET /items/randomitems`, `GET /searchitems` within the `normalizeItem` tolerance envelope (§8.4 Example B; audit §4, §7).
-- [ ] Serve admin categories CRUD via the existing `AdminCategoriesApiGateway` contract: `loadCategories`, `loadCategory`, `create/update/delete/restore`, `isSlugTaken` — per Categories CRUD contract (BACKEND_API.md §6.9). **Already wired client-side (DONE).**
+- [ ] Serve admin categories CRUD via the existing `AdminCategoriesApiGateway` contract: `loadCategories`, `loadCategory`, `create/update/delete/restore`, `isSlugTaken` — per Categories CRUD contract (archive/BACKEND_API.md §6.9). **Already wired client-side (DONE).**
 - [ ] Serve `GET /api/backoffice/products` and `GET /api/backoffice/categories` (storefront cards) — `ApiBackofficeDataProvider` is LIVE (audit §9).
 - [ ] Stand up `GET /regions` → `Region[]` (feeds the `X-Region` header; client falls back to 6 hardcoded regions) (audit §12).
 
 ### Phase 3 — Write-heavy customer domains
 
-- [ ] Keep `POST /cart` (`CartPaymentRequest` → `QrCreateResponse`) and the frozen QR/card payment polling working unchanged (§10; payments frozen per BACKEND_API.md §2.8).
-- [ ] Implement `POST /orders` (`CreateOrderRequest` → `CreateOrderResponse`) — client call is LIVE, fire-and-forget after payment (§10; BACKEND_API.md §16.9, marked DONE client-side).
+- [ ] Keep `POST /cart` (`CartPaymentRequest` → `QrCreateResponse`) and the frozen QR/card payment polling working unchanged (§10; payments frozen per archive/BACKEND_API.md §2.8).
+- [ ] Implement `POST /orders` (`CreateOrderRequest` → `CreateOrderResponse`) — client call is LIVE, fire-and-forget after payment (§10; archive/BACKEND_API.md §16.9, marked DONE client-side).
 - [ ] Implement `POST /purchase-email` (email receipt) (audit §4).
 - [ ] Accept review/question writes `POST /items/:id/callback` and `POST /items/:id/questiion` (**preserve the `questiion` typo** — it matches the client literal) (§11; audit §4).
 
 ### Phase 4 — Admin domains (each needs the token seam added first — §8.5)
 
-- [ ] Add `AdminOrdersGateway` token + `AdminOrdersApiGateway`, switch `AdminOrdersFacade` to the token; implement `GET/POST /backoffice/orders*` incl. `POST /backoffice/orders/:id/status` respecting the order state machine — per Orders CRUD contract (§8.4 Example C, §8.5; BACKEND_API.md §6.11/§8.1).
-- [ ] Add `AdminProductsGateway` token + `AdminProductsApiGateway`, switch `AdminProductsFacade`; implement Products CRUD + variants — per Products CRUD contract (§8.5; BACKEND_API.md §6.10/§7.2).
-- [ ] Add `AdminTransactionsGateway` token + api gateway, switch `AdminTransactionsFacade`; implement transactions list/detail + `retryFailed` + `setFraudFlag` (tied to orders) — per Transactions contract (§8.5; BACKEND_API.md §6.12).
-- [ ] Add `AdminUsersGateway` token + api gateway, switch `AdminUsersFacade`; implement users/roles/invitations/sessions/audit — per Users contract (§8.5; BACKEND_API.md §6.13). Reconcile the duplicate `AdminRole` naming (audit §25 #3).
-- [ ] Add `AdminModerationGateway` token + api gateway, switch `AdminModerationFacade`; implement review + report status transitions — per Moderation contract (§8.5; BACKEND_API.md §6.14/§8.4/§8.5).
-- [ ] Add `AdminMonitoringGateway` token + api gateway, switch `AdminMonitoringFacade`; implement events/queues/webhooks reads — per Monitoring contract (§8.5; BACKEND_API.md §6.16).
-- [ ] Wire `AdminDashboardMetricsApiGateway` to the existing `ADMIN_DASHBOARD_METRICS_GATEWAY` token; implement `loadMetrics` — per Dashboard contract (§8.5; BACKEND_API.md §6.15).
+- [ ] Add `AdminOrdersGateway` token + `AdminOrdersApiGateway`, switch `AdminOrdersFacade` to the token; implement `GET/POST /backoffice/orders*` incl. `POST /backoffice/orders/:id/status` respecting the order state machine — per Orders CRUD contract (§8.4 Example C, §8.5; archive/BACKEND_API.md §6.11/§8.1).
+- [ ] Add `AdminProductsGateway` token + `AdminProductsApiGateway`, switch `AdminProductsFacade`; implement Products CRUD + variants — per Products CRUD contract (§8.5; archive/BACKEND_API.md §6.10/§7.2).
+- [ ] Add `AdminTransactionsGateway` token + api gateway, switch `AdminTransactionsFacade`; implement transactions list/detail + `retryFailed` + `setFraudFlag` (tied to orders) — per Transactions contract (§8.5; archive/BACKEND_API.md §6.12).
+- [ ] Add `AdminUsersGateway` token + api gateway, switch `AdminUsersFacade`; implement users/roles/invitations/sessions/audit — per Users contract (§8.5; archive/BACKEND_API.md §6.13). Reconcile the duplicate `AdminRole` naming (audit §25 #3).
+- [ ] Add `AdminModerationGateway` token + api gateway, switch `AdminModerationFacade`; implement review + report status transitions — per Moderation contract (§8.5; archive/BACKEND_API.md §6.14/§8.4/§8.5).
+- [ ] Add `AdminMonitoringGateway` token + api gateway, switch `AdminMonitoringFacade`; implement events/queues/webhooks reads — per Monitoring contract (§8.5; archive/BACKEND_API.md §6.16).
+- [ ] Wire `AdminDashboardMetricsApiGateway` to the existing `ADMIN_DASHBOARD_METRICS_GATEWAY` token; implement `loadMetrics` — per Dashboard contract (§8.5; archive/BACKEND_API.md §6.15).
 - [ ] Resolve Customers: derive from the real Orders token (`AdminCustomersFacade`) or add a first-class customers source (§8.3).
-- [ ] Defer Analytics until orders/products/moderation are real and a tracking pipeline exists; then implement the analytics summary source (§8.3, §8.6 step 10; BACKEND_API.md §6.17).
+- [ ] Defer Analytics until orders/products/moderation are real and a tracking pipeline exists; then implement the analytics summary source (§8.3, §8.6 step 10; archive/BACKEND_API.md §6.17).
 
 ### Phase 5 — Builder / CMS (net-new write paths — no client call exists today)
 
-- [ ] Implement builder bootstrap draft/publish/validate: `GET/PUT /builder/bootstrap/draft`, `POST /builder/bootstrap/publish`, `POST /builder/bootstrap/validate` — and add the client-side write call in `ProjectEditorFacade`/`ProjectEditorIoService` (§8.3, §17; BACKEND_API.md §6.7). P0 for the builder.
-- [ ] Implement content pages / CMS write path and wire `ContentManagementFacade` beyond in-memory bootstrap (§8.3, §16; BACKEND_API.md §6.8).
-- [ ] Implement the media upload/delete/replace pipeline behind `ApiMediaRepository` bound to the `MediaRepository` token (§8.5; BACKEND_API.md §6.18/§10).
+- [ ] Implement builder bootstrap draft/publish/validate: `GET/PUT /builder/bootstrap/draft`, `POST /builder/bootstrap/publish`, `POST /builder/bootstrap/validate` — and add the client-side write call in `ProjectEditorFacade`/`ProjectEditorIoService` (§8.3, §17; archive/BACKEND_API.md §6.7). P0 for the builder.
+- [ ] Implement content pages / CMS write path and wire `ContentManagementFacade` beyond in-memory bootstrap (§8.3, §16; archive/BACKEND_API.md §6.8).
+- [ ] Implement the media upload/delete/replace pipeline behind `ApiMediaRepository` bound to the `MediaRepository` token (§8.5; archive/BACKEND_API.md §6.18/§10).
 
 ### Phase 6 — Hardening
 
@@ -4345,5 +4345,27 @@ independent. Section references point to the assembled backend-integration docum
 - [ ] Add audit logging for admin mutations (order status, role changes, moderation actions, publish) — the client already models `*AuditEntry` / timeline shapes (audit §23).
 - [ ] Implement maintenance-mode / graceful `backend-unavailable` responses the client can surface (§5b).
 - [ ] Implement `GET /items/batch?ids=` to unblock the user-experience id-only sync redesign (remaining-work #16; §8.3).
-- [ ] Add search suggestions/catalog-filter source if pursuing #15 (§8.6 step 12; BACKEND_API.md §6.6).
+- [ ] Add search suggestions/catalog-filter source if pursuing #15 (§8.6 step 12; archive/BACKEND_API.md §6.6).
 - [ ] Plan dynamic sitemap generation (server-side, no frontend action) (remaining-work #18).
+
+---
+
+## Appendix: `docs/TODO.md` items merged into this document (2026-07-26)
+
+Final Project Closeout moved every backend-shaped item out of `docs/TODO.md` into this
+document. None were duplicated as raw new bullets — each is already covered by an
+existing section above:
+
+| TODO item | Covered by |
+|---|---|
+| `bootstrap.json` real content (branding/theme/nav/seo) | §1 Bootstrap |
+| Builder bootstrap draft/publish/validate | §1 (Draft vs Published), §8, §9 Phase 5 |
+| Backoffice Products CRUD | §3 Products, §8, §9 Phase 4 |
+| Media upload/delete/replace pipeline | §7 Uploads, §9 Phase 5 |
+| Backoffice Orders CRUD + status transitions | §3 Orders, §8, §9 Phase 4 |
+| Backoffice Transactions | §3 Transactions, §9 Phase 4 |
+| Backoffice Users/roles/invitations | §3 Users/Roles, §9 Phase 4 |
+| Backoffice Moderation (reviews/reports) | §3 Reviews/Reports, §9 Phase 4 |
+| Backend Ready sprint / no real API contract | This entire document |
+
+`docs/TODO.md` is now empty of blockers — see that file.
diff --git a/docs/FRONTEND-ROADMAP.md b/docs/FRONTEND-ROADMAP.md
index f41b152..67bae8c 100644
--- a/docs/FRONTEND-ROADMAP.md
+++ b/docs/FRONTEND-ROADMAP.md
@@ -28,21 +28,14 @@ Found and fixed **2 P0s**: (1) `language.guard.ts`'s legacy-URL redirect broke q
 
 ## Known open items (not yet scheduled)
 
-Full detail in `docs/KNOWN-ISSUES.md`. Summary:
-- Payment modal / bank-payment iframe on Cart still custom (own focus-trap, multi-step state — note: RC A11Y-01 added a real focus-trap to it, but it's still not `app-dialog` itself) — candidate for `app-dialog` migration.
-- Cart's native `confirm()` on clear-cart — no existing confirm-dialog pattern to follow yet.
-- Genuine brand-color contrast failures (`--border-color`, `--success/warning/error/info-color` as text) — flagged by RC A11Y-01, need theme-owner sign-off before changing.
-- `stars.component` rating glyph color has no exact token match — needs a deliberate token-extension decision (the `pages/category`/`pages/search` half of this was resolved by deleting those files, see below).
-- Homepage hero-to-categories dead-space gap — traces to mock bootstrap config, not a code defect; needs real-tenant-data reproduction.
-- Footer "Contacts" link has no static-page content in mock data — needs a content decision (found during RC walkthrough).
-- Builder's static-page body editor is hidden inside a collapsed "Advanced" section, mislabeled "Source HTML (advanced)" — works, but needs a navigation/labeling decision (found during RC walkthrough).
-- ~178 missing `adminXxx.*` i18n keys across admin backoffice.
-- Theme Mode (dark/system) selector has no runtime CSS effect — real feature project, not a wiring fix.
-- ~~`dynamic-renderer/` pipeline exists but is unwired~~ — verified 2026-07-25 (RC-02 task 6): it IS wired, it's the live homepage rendering engine (`HomeComponent` → `WebsiteRuntimeFacade` → `PageRendererService`/`PageResolverService` → `DynamicPageLayoutComponent`). Prior "unwired" note was stale.
-- `primeng`/`primeicons` still in `package.json` despite the only consumer being deleted (RC PERF-01) — `npm uninstall` blocked by an unrelated broken `barry-cache` devDependency (`ETARGET`); fix that first.
-- 2 large lazy chunks (`project-editor` 320 kB, `catalog-container` 126 kB) — no mechanical split found, needs a dedicated task.
-- **RESOLVED 2026-07-25 (RC-02 task 6)**: `pages/category`, `pages/search`, `pages/item-detail`, `pages/info/**`, `pages/legal/**` (40+ files) were entirely unrouted dead code — deleted. See `docs/KNOWN-ISSUES.md` item 13.
-- Backend integration: still mostly PLANNED/mock — a "backend ready" sprint was attempted and explicitly deferred (2026-07-24) pending a real API contract (`docs/BACKEND_API.md` is the canonical spec — no live endpoint confirmation beyond what's already CURRENT).
+As of the 2026-07-26 Final Project Closeout, open items are split by category instead of one mixed list:
+- Real, reproducible frontend bugs: `docs/KNOWN-ISSUES.md` (one open item).
+- Items needing a client/business decision (dark mode, brand-color contrast, Contacts page content, advanced analytics, payment providers): `docs/PRODUCT_BACKLOG.md`.
+- Nice-to-have, non-blocking future work (Angular 22, bundle splitting, cart-modal composition cleanup, hero-spacing investigation): `docs/FUTURE_FEATURES.md`.
+- Backend integration: fully specified, not yet implemented — the single canonical spec is `docs/BACKEND_INTEGRATION.md`.
+- Release blockers: `docs/TODO.md` — currently none.
+
+Overall status: `docs/PROJECT_STATUS.md`.
 
 ## Not audited / out of scope
 
diff --git a/docs/FUTURE_FEATURES.md b/docs/FUTURE_FEATURES.md
new file mode 100644
index 0000000..c95218f
--- /dev/null
+++ b/docs/FUTURE_FEATURES.md
@@ -0,0 +1,19 @@
+# Future Features
+
+Nice-to-have, non-blocking work — no client decision needed, just not worth doing now. Verified against current repo state 2026-07-26.
+
+## Cart payment modal → `app-dialog` migration
+
+`.bank-payment-modal` on the cart page is a custom overlay component with its own focus-trap (added during the WCAG audit) rather than the shared `app-dialog` primitive. Functionally and accessibly complete as-is — migrating it to the shared primitive is a composition cleanup, deliberately deferred across every polish pass so far because it touches multi-step payment state.
+
+## Angular 22 upgrade
+
+Researched, not executed. Estimated ~2–3.5 days, needs the `barry-cache` dependency fix and a Node version bump first. Explicitly out of scope for the Backend Finalization Sprint. Plan: `docs/ANGULAR22_PLAN.md`.
+
+## Bundle splitting
+
+Two lazy chunks are large: `project-editor` (320 kB), `catalog-container` (126 kB). No mechanical split found yet — needs a dedicated profiling task.
+
+## Homepage hero-to-categories spacing investigation
+
+A dead-space gap between the hero and categories section on the storefront home page traces to bootstrap mock config (widget/section padding values in the dev fixture), not a confirmed code defect. Needs reproduction with real tenant data before it's worth investigating further — not a bug until it's confirmed to happen outside the mock fixture.
diff --git a/docs/KNOWN-ISSUES.md b/docs/KNOWN-ISSUES.md
index c20c740..5ceab63 100644
--- a/docs/KNOWN-ISSUES.md
+++ b/docs/KNOWN-ISSUES.md
@@ -1,368 +1,41 @@
-# Known Issues (fix after sprint wrap-up)
+# Known Issues
 
-Running list of bugs spotted during manual verification, deferred until the
-current sprint's feature work is done. Add to this list as more are found;
-don't fix inline unless asked.
+Real, reproducible, currently-open frontend bugs only. Everything that needed a product/business decision moved to `docs/PRODUCT_BACKLOG.md`; everything nice-to-have moved to `docs/FUTURE_FEATURES.md`; everything backend-shaped moved to `docs/BACKEND_INTEGRATION.md`. Re-verified against source 2026-07-26.
 
 ## Open
 
-1. **Homepage hero-to-categories dead space gap on the storefront home
-   page.** Traces to bootstrap mock config (widget/section padding values
-   in the dev bootstrap fixture), not a code defect in
-   `dynamic-page-layout.component.ts` or the widget components - not fixed
-   this session, needs config-side investigation if it reproduces with
-   real tenant data rather than mock config.
+1. **Ed25519 admin-auth error codes `session-expired` and `invalid-signature` are unreachable — dead UI.**
+   `AuthError.code` is documented as routing to a dedicated recovery screen per code
+   (`core/auth/models/auth-error.model.ts:1-4`), but `toAuthErrorShape()` in
+   `core/auth/services/auth.service.ts:110-118` derives the code for any real
+   `HttpErrorResponse` *exclusively* from `authErrorCodeFromStatus(error.status)`
+   (line 112) — it never reads the caller-supplied `fallbackCode` parameter for
+   real HTTP errors, and never reads any body-level error code from the response.
+   `authErrorCodeFromStatus()` (`auth-error.model.ts:21-32`) only ever returns
+   `'unauthorized'`, `'forbidden'`, or `'backend-unavailable'` — there is no status
+   or body condition anywhere in the codebase that produces `'session-expired'` or
+   `'invalid-signature'`. Both screens exist and are wired, but are permanently
+   unreachable from any real backend response today.
+   - **Fix requires both sides**: a backend that returns a distinguishable
+     `error.code` in the response body (see `docs/ERROR_CONTRACT.md`), and a small
+     frontend change to `toAuthErrorShape()` to prefer that body code over the
+     blanket status-based fallback.
+   - Found: 2026-07-26, Backend Finalization Sprint documentation pass (traced while
+     writing `docs/AUTHENTICATION.md`/`docs/ERROR_CONTRACT.md`).
 
-2. **~179 untranslated raw i18n keys across the entire admin backoffice CRUD
-   UI (products/categories/orders/transactions/users/monitoring/analytics).**
-   `translations.ts`/`en.ts`/`ru.ts`/`hy.ts` have no `adminProducts.*`,
-   `adminCategories.*`, `adminOrders.*`, `adminTransactions.*`,
-   `adminUsers.*`, `adminMonitoring.*`, or `adminAnalytics.*` sections at all
-   (confirmed: zero matches for any of these prefixes in any of the 4 i18n
-   files). `TranslateService.t()` falls through to returning the raw dotted
-   key string when a key isn't found (see `translate.service.ts`), so every
-   templated string in these features (buttons, table headers, filters,
-   badges, empty/placeholder text) renders literally as e.g.
-   `adminProducts.create` instead of real copy - same root cause as the
-   already-fixed dashboard Quick Actions bug below, just at the scale of
-   almost the entire admin backoffice built across Sprints 20-27.
-   - Counted by grepping all `'adminXxx.yyy'` translate-pipe usages under
-     `src/app/features/admin/**`: `adminProducts` 72, `adminCategories` 23,
-     `adminOrders` 24, `adminUsers` 21, `adminMonitoring` 13,
-     `adminAnalytics` 12, `adminTransactions` 13 (≈178 distinct keys, ×3
-     locales ≈ 534 strings to author).
-   - Likely why it was never caught: every affected Sprint (20-27) explicitly
-     noted live-browser click-through was blocked on the guarded admin route
-     and verification was tsc/build/arch:check only - none of those catch
-     missing i18n keys (pipe arguments are plain strings, not type-checked).
-   - Found: 2026-07-15, during Sprint 28 manual audit (reading templates +
-     grepping i18n files, not live browser).
-   - **Deferred to Sprint 29** ("translation validation" is explicit Sprint 29
-     scope per `SPRINT-PLAN.md` (removed, see git history)) rather than fixed inline during Sprint
-     28 polish - authoring ~534 correct strings across 3 languages is a large,
-     separate, mechanical pass of its own and shouldn't be rushed inside a
-     polish sprint. Sprint 28 only adds the handful of new keys it introduces
-     itself (empty-state copy for the skeleton/empty-state consistency fix),
-     it does not touch the ~178 pre-existing gap.
+## Fixed (this cycle)
 
-3. **Theme Mode selector has no runtime effect.** `theme-section`'s light/dark/
-   system dropdown saves correctly and `theme-engine.service.ts` sets a
-   `data-theme-mode` attribute on `<html>`, but no CSS anywhere in the app
-   reads that attribute — picking Dark or System changes nothing visually
-   today. Theme palette colors are unaffected (they're real CSS custom
-   properties, genuinely live). Fixing this means implementing actual
-   dark-mode CSS (a dark palette + `[data-theme-mode]`/`prefers-color-scheme`
-   strategy + a `matchMedia` listener for "system", since that can change
-   without a reload) — a real feature project, not a wiring fix.
-   - Found: 2026-07-17, project-editor bug-hunt audit (`docs/EDITOR.md`).
+Condensed — full detail in commit history and `docs/RELEASE_REPORT.md`.
 
-4. **`dynamic-renderer/` pipeline exists but is never wired up.**
-   `src/app/dynamic-renderer/{page-renderer,section-renderer,section-engine,
-   page-resolver,widget-host}` has services and models but zero components
-   or templates (every directory has only a `.gitkeep`). The storefront
-   homepage renders through a separate, older path that doesn't consume it.
-   Two editor fields feed this dead pipeline with no visible effect:
-   `layout.type` (Theme section, "Site Layout") and the homepage section's
-   own `type` field (`homepage-section.component.ts`'s
-   `updateSection(id, 'type', ...)` has no UI calling it, because of this).
-   Needs a decision: finish wiring it in (if it's WIP for a planned
-   replacement) or delete it as abandoned scaffolding.
-   - Found: 2026-07-17, project-editor bug-hunt audit.
-
-5. **`HeaderConfig.showProfile` toggle has no corresponding UI.** The header
-   editor's "Profile" toggle updates a real config field, but
-   `header.component.html` never references `showProfile` — there's no
-   profile/account menu in the storefront header to show or hide. Needs an
-   auth-system check first (does one exist yet?) before building the menu.
-   - Found: 2026-07-17, project-editor bug-hunt audit.
-
-6. **Payment modal / bank-payment iframe on Cart still custom, not `app-dialog`.**
-   Correction (2026-07-24, RC A11Y-01): the "already has focus-trap" assumption
-   below was wrong — it had none. RC A11Y-01 ported `app-dialog`'s confirmed-
-   correct focus-trap/Escape/return-focus pattern directly onto it
-   (`ACCESSIBILITY_REPORT.md` (removed, see git history)), so the accessibility gap is closed. It's
-   still a separate custom component, not the shared `app-dialog` itself —
-   migrating it to the actual primitive remains a composition change,
-   deliberately left out of every polish pass so far.
-   - Found: 2026-07-23, RC-Premium-01 (`STORE_FRONT_UX_REVIEW.md` (removed, see git history)).
-
-7. **Cart's `clearCart()` uses native `confirm()`, no styled confirm dialog.**
-   No existing storefront pattern for a confirm-remove dialog to follow yet —
-   introducing the first one is an architecture decision, not polish.
-   - Found: 2026-07-23, RC-Premium-01.
-
-8. ~~`stars.component` rating glyph color and a few legacy hex literals in
-   `pages/category`/`pages/search` have no exact design-token match.`~~
-   **Resolved 2026-07-25 (RC-02 task 6):** `pages/category`/`pages/search`
-   deleted as unrouted dead code (see item 13). `stars.component` literals
-   remain, tracked separately if still relevant.
-   - Found: 2026-07-23, RC-Premium-01.
-
-9. **Genuine brand-color contrast failures (WCAG AA).** `--border-color`
-   fails 3:1 UI-component contrast in every theme (1.24-1.42:1 measured);
-   `--success/--warning/--error/--info-color` fail 4.5:1 when used as plain
-   text-on-white in a handful of places. Real palette colors, not a token
-   bug — fixing means visibly changing the brand, needs theme-owner sign-off.
-   - Found: 2026-07-24, RC A11Y-01 (`ACCESSIBILITY_REPORT.md` (removed, see git history)).
-
-10. **Footer "Contacts" link has no static-page content in mock data.**
-    Unlike the "About" link (which was a route-name mismatch, fixed), no
-    content exists for Contacts at all — needs a content decision, not a
-    code fix.
-    - Found: 2026-07-24, Release Candidate walkthrough (`RELEASE_REPORT.md` (removed, see git history)).
-
-11. **Builder's static-page body editor is hidden and mislabeled.** The
-    actual WYSIWYG content editor isn't on the "Content" tab (title/image
-    only) — it's inside a collapsed `<details>` under "Advanced", labeled
-    "Source HTML (advanced)" though it's the only way to edit page content.
-    Works correctly once found; relocating/relabeling is a navigation
-    decision, not a bug fix.
-    - Found: 2026-07-24, Release Candidate walkthrough.
-
-12. **`primeng`/`primeicons` still in `package.json` after their only
-    consumer was deleted.** `npm uninstall` fails (`ETARGET`) on a
-    pre-existing, unrelated broken `barry-cache` devDependency resolution —
-    fix that first, then drop the now-fully-unused dependency (likely closes
-    most of the remaining bundle-budget overage in one move).
-    - Found: 2026-07-24, RC PERF-01 (`PERFORMANCE_REPORT.md` (removed, see git history)).
-
-13. **RESOLVED 2026-07-25 (RC-02 task 6) — `pages/category/*`, `pages/search/*`,
-    `pages/item-detail/*`, `pages/info/**`, `pages/legal/**` (40+ files) were
-    entirely unrouted dead code, not live pages.** Decision: delete (not
-    wire up) — each had a live replacement already serving its traffic.
-    Verified directly against `src/app/app.routes.ts`:
-    `category/:id` and `category/:id/items` `redirectTo: 'catalog/:id'`
-    (served by `CatalogContainerComponent`); `search` also routes to
-    `CatalogContainerComponent`; `product/:id` routes to
-    `ProductDetailsContainerComponent`, not `pages/item-detail`;
-    `cmsContentRoutes` (meant to route `pages/info/**`/`pages/legal/**`) is a
-    literal empty array (`app.routes.ts:292`) behind a
-    `// TODO(CMS): Resolve informational/legal pages from backend content
-    configuration here` comment — About/Contacts/FAQ/Delivery/Guarantee/
-    Company-Details/Payment-Terms/Return-Policy/Public-Offer/Privacy-Policy
-    are all actually served by the catch-all `:staticPath` route resolving
-    `bootstrap.staticPages` (`pages/static-page/static-page.component.ts`),
-    confirmed independently by `docs/FRONTEND.md`'s own routing section
-    ("Static/CMS pages resolve dynamically... no hardcoded page list").
-    **This means several "fixes" earlier in this document and in
-    since-deleted audit reports (see git history) were applied to dead code
-    with zero production effect**
-    — see the correction note on Fixed item 7 below. This was missed by
-    three separate passes this cycle (RC-Premium-01, RC STORE-01, and the
-    dead-code cleanup sprint, which manually re-verified against
-    `app.routes.ts` and still concluded these files were live — an error in
-    that verification, not a tooling blind spot this time) before being
-    caught during the documentation-consolidation pass. Needs a decision:
-    wire `cmsContentRoutes` back up (restoring 10 hardcoded per-locale pages
-    that duplicate what the CMS static-page renderer already does), or
-    delete all 40+ files as genuinely dead now that the duplication is
-    confirmed intentional-by-omission rather than accidental.
-    - Found: 2026-07-25, Documentation Cleanup pass.
-
-14. **No `canDeactivate` guard on `admin/products/:id/edit`.** Categories
-    protect against navigating away with unsaved changes
-    (`adminCategoryDirtyGuard`, `app.routes.ts:121,131`); products do not,
-    despite `AdminProductsFacade` having its own dirty-tracking draft logic.
-    Inconsistent, low-effort fix (mirror the categories guard) but not
-    applied here — this pass is documentation-only.
-    - Found: 2026-07-19 (`PROJECT-STATE.md` (removed, see git history)), re-verified
-      2026-07-25 against current `app.routes.ts` — still true.
-
-## Fixed
-
-1. **Full-project UX/UI + motion pass across storefront, admin dashboard,
-   admin CRUD, and project-editor.**
-   User asked (2026-07-16) for a full UX/UI audit across admin, dashboard,
-   and storefront, sequenced: storefront -> admin dashboard -> admin CRUD ->
-   project-editor. All 4 phases completed:
-   - Fixed: `project-editor-save-bar` buttons were plain unstyled `<button>`s
-     (`project-editor-save-bar.component.html/.scss`) - now use the shared
-     `app-button` primitive.
-   - Fixed: `.platform-nav-group` (`header.component.html/.scss`) applied
-     `platform-nav-btn-left` to every nav button regardless of position,
-     causing double borders and wrong end-radius; replaced with
-     `:first-child`/`:last-child`/`:not(:first-child)` structural selectors,
-     dropped the dead `-middle`/`-right` classes.
-   - Polished: storefront widgets used on every page -
-     `hero-widget.component.ts`, `categories-widget.component.ts`,
-     `product-carousel-widget.component.ts`,
-     `footer-navigation-widget.component.ts` - added design tokens, hover/
-     focus states, 44px touch targets, entrance motion, all gated behind
-     `prefers-reduced-motion`.
-   - Polished: `admin-dashboard-card.component.scss` and
-     `admin-dashboard-quick-actions.component.scss` - hover lift, entrance
-     animation, reduced-motion guard.
-   - Audited: admin backoffice CRUD (products/categories/orders/users/
-     transactions/monitoring/analytics) - already consistently built on the
-     shared `app-button`/`app-table`/`app-badge`/`app-empty-state`/
-     `app-pagination` primitives from earlier sprints; grepped all 7 areas
-     for raw unstyled `<button>`s (the save-bar bug pattern) and found only
-     one: the gallery-image remove badge in
-     `admin-product-form.component.scss` (`.gallery-item button`) had no
-     hover/focus state and a 20x20px hit area below the 44px touch-target
-     minimum - fixed with hover/focus-visible states and an invisible
-     `::before` inset to expand the hit area without changing the visual
-     badge size.
-   - Fixed: `section.shared.scss` (used by all 11 project-editor sections)
-     had a bare `button`/`button.secondary` style with zero hover, focus, or
-     transition - added hover/active/focus-visible/disabled states plus
-     `prefers-reduced-motion` guard, applied uniformly across every section.
-   - Added: `project-editor-page.component.scss` `.project-editor-stack > *`
-     now fades/slides in (220ms) whenever `@switch` swaps the active
-     section component; `.project-editor-section-actions button` (reset
-     section) got the same hover/focus treatment as the rest of the shared
-     button styles.
-   - Verified: `tsc --noEmit` clean after every batch of edits; live-checked
-     in browser at each phase (homepage nav-group render, save-bar render,
-     dashboard cards, project-editor section switch + reset button).
-   - One dev-server crash occurred mid-session (unrelated pre-existing
-     `ng serve` process died independently of these edits, confirmed via
-     `curl` connection-refused before restart) - restarted via
-     `npm run dexar`, not a regression from this work.
-   - See item 1 below (homepage dead-space gap) for the one issue found
-     but not fixed (config data, not code).
-
-2. **Project Editor footer: payment icons and social links had no validation.**
-   `footer-section.component.ts` parsed both fields from pipe-delimited
-   `<textarea>` strings (`icon.src|icon.alt`, `link.id|link.label|link.url`)
-   with zero validation - malformed rows silently produced empty `src`/`alt`/
-   `url` values instead of surfacing an error.
-   - Fixed: 2026-07-16, replaced both textareas with `app-key-value-editor`
-     rows (icon picked via `MediaPickerComponent`, label/URL via `app-input`),
-     added inline URL-format validation on social links (same `HTTP_URL`
-     pattern used in `project-validator.service.ts`) and a missing footer-logo
-     media picker.
-
-3. **Project Editor navigation: nav link labels only editable for the default locale.**
-   `navigation-section.component.ts`'s `labelOf` helper (and the facade's
-   `updateNavLinkLabel`) always read/wrote the default locale's key on a
-   `NavigationLocalizedText` label map, so switching locales elsewhere in the
-   editor had no effect on nav link text - other locales' translations could
-   only be edited by hand-editing the exported JSON.
-   - Fixed: 2026-07-16, added `app-locale-tabs` to the section; the label
-     input now reads/writes the active tab's locale via a new
-     `editableLabel()` helper, and `ProjectEditorFacade.updateNavLinkLabel()`
-     gained an optional `locale` parameter (defaults to the current default
-     locale, so existing callers are unaffected).
-
-4. **Quick Actions: 3 untranslated raw i18n keys.**
-   `dashboard.actionUsers`, `dashboard.actionMonitoring`,
-   `dashboard.actionAnalytics` rendered as literal key strings instead of
-   translated labels on the admin dashboard's Quick Actions section, because
-   `admin-dashboard.facade.ts` referenced them but they were never added to
-   `translations.ts`/`en.ts`/`ru.ts`/`hy.ts`.
-   - Found: 2026-07-15, manual browser verification of
-     `/:lang/backoffice/dashboard?devBypassAdmin=true`.
-   - Fixed: 2026-07-15, added the 3 keys to the interface + all 3 locales.
-
-5. **Project Editor: 9 real correctness bugs across footer, features,
-   widgets, languages, preview, static-pages, general, branding/SEO, and the
-   shared media picker.** Found via a section-by-section "does this control
-   actually do what it claims at runtime" audit, not a feature pass. Full
-   detail (repro steps, fix, live verification) in `docs/EDITOR.md`'s
-   "Bug-hunt audit pass (2026-07-17)" section — summary:
-   - Footer social-link/payment-icon id generation reproducibly collided
-     (array-length-derived / fixed suffix), corrupting `@for (track item.id)`
-     identity on the public storefront footer.
-   - Features' wishlist/compare toggle only drove one of the two flags that
-     actually gate visibility at runtime.
-   - Widgets' JSON-fallback textarea silently discarded invalid edits instead
-     of showing an error.
-   - Languages' add-locale silently no-opped on a duplicate code.
-   - Preview's import bypassed undo history and draft `localStorage`
-     persistence entirely.
-   - Static Pages' create/duplicate-page slug generation had the same
-     collision bug as the footer one.
-   - General's free-text language fields bypassed `LocaleSyncService`
-     (no translation-entry propagation) and had no guard against an
-     unsupported default locale.
-   - Branding's `socialImageUrl` field (added earlier the same session) was
-     never actually read by `SeoService` — dead on arrival until wired in.
-   - The shared `app-media-picker`'s backing facade is a root singleton;
-     search/folder/page filters leaked between independently-opened picker
-     dialogs on the same page.
-   - Found & fixed: 2026-07-17. Each bug was reproduced live via
-     `window.ng.getComponent()` before fixing and re-verified after.
-   - 3 further gaps were found but are real feature work, not wiring bugs —
-     moved to Open (items 3-5 above) rather than fixed inline: Theme Mode
-     has no runtime effect, the `dynamic-renderer/` pipeline is unwired,
-     and the header's Profile toggle has no corresponding menu.
-
-6. **`admin/categories` facade: dead create-draft recovery + broken
-   drag-reorder.** Found via the same bug-hunt method as project-editor's
-   audit, applied to `admin/products` + `admin/categories`. Full detail
-   (repro steps, fix, live verification) in `docs/ADMIN.md`'s "Bug-hunt audit
-   pass (2026-07-17)" section - summary:
-   - `startCreate()` generated a fresh `category-${Date.now()}` id every
-     call and keyed the `localStorage` autosave draft off it, so create-mode
-     draft recovery could never find a match (even within the same tab,
-     seconds apart) and orphaned an entry every abandoned attempt.
-   - `reorder(id, targetOrder)` wrote the dropped-on row's `order` value
-     straight onto the dragged category, tying two siblings on the same
-     `order` instead of repositioning - and since every seeded category
-     starts at `order: 0`, every drag on fresh data was a silent no-op.
-   - Found & fixed: 2026-07-17. Each reproduced live via
-     `window.ng.getComponent()` before fixing, re-verified after (real
-     backend unreachable in this environment, so via
-     `facade.categories.set([...])` synthetic siblings feeding the same
-     facade methods/gateway calls the UI drives).
-   - A third bug from the same audit pass, fixed in a follow-up commit:
-     `admin-product-form`/`admin-category-form` hardcoded translation-tab
-     locales to `['en','ru','hy']` instead of the tenant's actual
-     `supportedLocales`. Fixed by giving `AdminProductsFacade`/
-     `AdminCategoriesFacade` a `supportedLocales` computed +
-     `ensureLocalesLoaded()` reading/lazily-loading
-     `ProjectEditorFacade.bootstrap()` (same pattern
-     `AdminDashboardFacade.ensureLoaded()` already uses), threaded down to
-     both form components via a new `locales` `@Input()`. Verified live:
-     rendered tab order changed from the hardcoded `['en','ru','hy']` to the
-     real tenant order `['ru','en','hy']` in both editors.
-
-7. **`pages/category` and `pages/search` hand-rolled skeleton markup
-   replaced with shared `app-skeleton`.** Both pages had their own
-   `.skeleton-card`/`.skeleton-image`/`.skeleton-line` shimmer CSS with
-   hardcoded hex colors, duplicating what `app-skeleton` already provides
-   and what `catalog-container`/`product-details-container` already use.
-   - Fixed: 2026-07-23, RC STORE-01 (`STORE_REVIEW.md` (removed, see git history)).
-   - **Superseded 2026-07-25 (RC-02 task 6):** these files were confirmed
-     unrouted dead code (item 13) and deleted outright, making this fix
-     moot. Live category/search rendering goes through
-     `CatalogContainerComponent`, not these files.
-
-8. **Cart's dead `.email-form` markup and CSS removed.** Post-payment
-   email/phone-capture form was commented-out markup with a matching
-   ~90-line dead CSS block still shipping in the bundle.
-   - Fixed: 2026-07-23, RC STORE-01.
-
-9. **App-wide query-param routing broken (P0).** `language.guard.ts`'s
-   legacy-URL redirect built the target with `router.createUrlTree([...])`
-   using a single path-segment string with the query string baked in, so it
-   got percent-encoded into the path instead of parsed as query params
-   (`/edit/branding?devBypassAdmin=true` → `/ru/edit/branding%3FdevBypassAdmin%3Dtrue`,
-   a dead route). This guard runs on every top-level route app-wide, so any
-   bookmarked/shared deep link with query params was silently broken —
-   found during the Builder RC walkthrough but affects all 3 surfaces.
-   - Fixed: 2026-07-24, Release Candidate walkthrough (`RELEASE_REPORT.md` (removed, see git history)),
-     `router.parseUrl()` instead of a hand-built path segment.
-
-10. **Backoffice Categories CRUD completely broken end-to-end (P0).**
-    `admin-categories-gateway.token.ts` resolved via
-    `RuntimeProviderStrategyService.getBackofficeProviderMode()`, which —
-    unlike `getBootstrapProviderMode()` — has no `isLocalhost()` fallback,
-    so it always picked the real HTTP `AdminCategoriesApiGateway` instead of
-    the local mock in an environment with no real backend. Combined with
-    `saveDraft()` having no error handler: every create/publish click
-    silently failed, `dirty` never cleared, and the unsaved-changes guard
-    then blocked navigation with zero feedback.
-    - Fixed: 2026-07-24, Release Candidate walkthrough, wired to the
-      already-defined `getCategoryProviderMode()` + added the same
-      `isLocalhost()` fallback `getBootstrapProviderMode()` already had.
-      Live-verified: create/edit/reorder all persist correctly now.
-
-## Notes (not bugs, just flag before shipping)
-
-- `src/environments/environment.ts`: `useMockData` was temporarily flipped to
-  `true` during this session's manual verification (so Categories/Products
-  dashboard cards showed mock counts instead of erroring against a
-  nonexistent local `/api/backoffice/*` backend), then reverted back to
-  `false` afterward - matches its pre-session value.
+- App-wide query-param routing broken (P0) — `language.guard.ts` legacy redirect percent-encoded query strings into the path.
+- Backoffice Categories CRUD broken end-to-end (P0) — wrong provider-mode fallback always picked the real HTTP gateway with no backend present.
+- Cart/builder native `confirm()`/`alert()` (16 call sites) replaced with shared `app-confirm-dialog` / toast service.
+- `getMainImage()` no-photo fallback and footer payment-icon assets referenced files that didn't exist — both fixed, `onerror` fallback added everywhere.
+- Backoffice Monitoring showed raw HTTP/queue/webhook strings by default — now friendly wording with technical detail collapsed behind a `<details>`.
+- Category/subcategory empty states used apology wording ("Oops!") for a normal zero-results state.
+- `pages/category`, `pages/search`, `pages/item-detail`, `pages/info/**`, `pages/legal/**` (40+ files) were unrouted dead code — deleted.
+- `dynamic-renderer/` was believed unwired — verified it's the live homepage rendering pipeline, no action needed.
+- `admin/products/:id/edit` missing `canDeactivate` guard — added, mirrors categories.
+- `primeng`/`primeicons` unused dependency — removed.
+- Builder static-page body editor hidden inside a mislabeled collapsed section — un-hidden, relabeled.
+- Several project-editor/admin-categories correctness bugs (footer icon id collisions, features toggle only driving one flag, languages silent duplicate no-op, static-pages slug collision, branding `socialImageUrl` never read, media-picker facade filter leakage between dialogs, categories draft-recovery/drag-reorder bugs, hardcoded locale-tab order) — see git history for the full per-bug list.
diff --git a/docs/NEXT_PHASE.md b/docs/NEXT_PHASE.md
new file mode 100644
index 0000000..519768d
--- /dev/null
+++ b/docs/NEXT_PHASE.md
@@ -0,0 +1,39 @@
+# Next Phase — Post-Backend-Integration Work
+
+Everything here assumes a real backend implementing `docs/BACKEND_INTEGRATION.md` exists. None of this can start before that. Not a re-statement of the backend checklist itself (`BACKEND_INTEGRATION.md` §9 owns that) — this is what the frontend needs to do once a real API is reachable.
+
+## Connect gateways
+
+Swap every mock gateway for a real one behind its existing (or newly-added) DI token, per the migration checklist in `BACKEND_INTEGRATION.md` §8. Order matters — follow §8's dependency-ordered sequence (auth/tenant/bootstrap first, then read-heavy catalog domains, then write-heavy customer domains, then admin domains, then builder/CMS).
+
+## Remove mocks
+
+Once every domain has a real gateway bound and verified, retire the `*LocalGateway`/mock repository implementations (or gate them behind an explicit dev-only flag if they're still useful for offline frontend development). Remove `useMockData`/mock-interceptor paths that are no longer reachable.
+
+## Wire dormant auth
+
+Register the Ed25519 `authInterceptor` in `app.config.ts` and attach `ed25519AuthGuard` to admin routes once a real backend can issue/verify challenges — currently fully built but not activated. Fix the `toAuthErrorShape()` gap noted in `KNOWN-ISSUES.md` so `session-expired`/`invalid-signature` screens become reachable once the backend returns a body-level error code.
+
+## Enforce the role model
+
+Wire the existing (currently unenforced) `AdminRole` model into route guards and UI gates — right now anyone who passes admin auth has full access regardless of role.
+
+## Integration testing
+
+No automated test suite exists yet for any of the touched areas. Once real endpoints exist, this is the point to add integration tests against them (not against mocks) — facade-level tests verifying real request/response shapes match `BACKEND_INTEGRATION.md`.
+
+## E2E tests
+
+Critical flows worth covering first: storefront checkout (cart → order → payment), admin product/category CRUD, builder draft → publish → live storefront reflects the change, admin auth (once Ed25519 is live).
+
+## Performance profiling
+
+Real backend latency will differ from the instant mock responses today — re-profile loading states, skeleton timing, and the two known large lazy chunks (`project-editor`, `catalog-container`) under real network conditions before committing to a bundle-splitting approach.
+
+## Production monitoring
+
+Wire real error tracking/APM once real endpoints exist — the current admin Monitoring page is mock activity data with no real event source. Decide on the actual monitoring/observability stack as part of backend infra (out of frontend scope, but the frontend's Monitoring UI is ready to display real events once real events exist — see `BACKEND_INTEGRATION.md` §3 Monitoring).
+
+## Maintenance mode
+
+Build the frontend UI gaps explicitly flagged as not existing yet in `docs/MAINTENANCE_MODE.md` (full-page maintenance takeover, per-module inline banners, scheduled-maintenance countdown) once the backend maintenance-mode contract (also in that doc) is decided and implemented.
diff --git a/docs/PRODUCT_BACKLOG.md b/docs/PRODUCT_BACKLOG.md
new file mode 100644
index 0000000..89ffa16
--- /dev/null
+++ b/docs/PRODUCT_BACKLOG.md
@@ -0,0 +1,39 @@
+# Product Backlog
+
+Items that need a client/business decision before any code is written — not blockers, not bugs, not backend work. Verified against current repo state 2026-07-26.
+
+## Dark mode / Theme selector
+
+`theme-section`'s light/dark/system dropdown saves correctly and `theme-engine.service.ts` sets a `data-theme-mode` attribute on `<html>`, but no CSS anywhere in the app reads that attribute — picking Dark or System changes nothing visually today. Theme palette colors themselves are unaffected (real CSS custom properties, genuinely live).
+
+**Decision needed:** does the client want a real dark mode? If yes, this is a real feature project (dark palette + `[data-theme-mode]`/`prefers-color-scheme` strategy + a `matchMedia` listener for "system"), not a wiring fix.
+
+## Brand color contrast (WCAG AA)
+
+`--border-color` fails 3:1 UI-component contrast in every theme (1.24–1.42:1 measured); `--success`/`--warning`/`--error`/`--info-color` fail 4.5:1 when used as plain text-on-white in a handful of places. These are real palette colors, not a token bug — fixing means visibly changing the brand.
+
+**Decision needed:** theme-owner sign-off on adjusted brand colors before any change ships.
+
+## Design-token gap: `stars.component` rating glyph color
+
+`src/app/features/website/product/engagement/components/stars/stars.component.scss:10` uses a literal hex (`#cdd6d5`) with no matching design token.
+
+**Decision needed:** add a token for this exact shade, or intentionally reuse an existing token (visual shift either way) — needs a design-system owner's call, not an engineering guess.
+
+## Footer "Contacts" page content
+
+The footer's "Contacts" link (`footer-contacts` / `nav.contacts`) has no static-page content in the bootstrap mock data at all — unlike "About" (which was a route-name mismatch, already fixed), there's simply nothing written for Contacts.
+
+**Decision needed:** what should the Contacts page actually say (address, phone, hours, map?) — a content question, not a code fix.
+
+## Advanced analytics (traffic, funnels, heatmaps)
+
+No data source exists for site traffic, conversion funnels, or heatmaps anywhere in the frontend or backend plan — this is a from-scratch analytics pipeline, not a missing endpoint.
+
+**Decision needed:** does the client want this for launch or later, and which analytics vendor/build to use (build vs. buy).
+
+## Payment providers
+
+Current checkout supports QR and card via the existing custom payment flow (`bank-payment-modal`, `payViaCard`). No alternative payment providers are wired or planned.
+
+**Decision needed:** if additional payment providers (e.g. wallets, buy-now-pay-later) are wanted, needs a business decision on which providers before any integration work starts.
diff --git a/docs/PROJECT_INDEX.md b/docs/PROJECT_INDEX.md
index 0f6c6c4..772a49b 100644
--- a/docs/PROJECT_INDEX.md
+++ b/docs/PROJECT_INDEX.md
@@ -18,7 +18,7 @@ Every tenant has three surfaces on this one codebase:
 - **Rendering**: Bootstrap JSON → Section Engine → Page Renderer → Widget Host → registered widget component (ADR-005). 100% lazy-loaded routes.
 - **Theming**: CSS custom properties per tenant, 3 theme stylesheets, never hardcoded hex in a component (ADR-008). Design system spec: [`DESIGN.md`](../DESIGN.md) (root of repo).
 - **i18n**: 3 locales (en/ru/hy), compile-time-enforced key parity across locale files.
-- **Backend**: mostly PLANNED (mock gateways behind swappable provider tokens) — see [BACKEND_API.md](BACKEND_API.md) for the full CURRENT/PLANNED/FUTURE endpoint spec, [BACKEND_API_REMAINING_WORK.md](BACKEND_API_REMAINING_WORK.md) for the prioritized punch list. Categories is the one domain fully wired to a real HTTP gateway; everything else is local/mock.
+- **Backend**: mostly PLANNED (mock gateways behind swappable provider tokens) — see [BACKEND_INTEGRATION.md](BACKEND_INTEGRATION.md), the single canonical backend spec (endpoints, DTOs, auth, security, error model, uploads, migration guide, checklist). Categories is the one domain fully wired to a real HTTP gateway; everything else is local/mock.
 
 ## Doc index (living documents)
 
@@ -27,17 +27,22 @@ Read these directly — they're the current source of truth, not one-off reports
 | Doc | What it covers |
 |---|---|
 | [ARCHITECTURE.md](ARCHITECTURE.md) | Layered architecture, container/facade/service pattern, bootstrap/theme/widget engines, links to the enforced ADRs |
-| [BACKEND_API.md](BACKEND_API.md) | Canonical backend/API spec — every endpoint, DTO, state machine, error contract |
-| [BACKEND_API_REMAINING_WORK.md](BACKEND_API_REMAINING_WORK.md) | Prioritized backend punch list (companion to the spec above) |
+| [BACKEND_INTEGRATION.md](BACKEND_INTEGRATION.md) | **Canonical backend spec** — every endpoint, DTO, CRUD contract, auth, security, error model, uploads, migration guide, checklist |
+| [AUTHENTICATION.md](AUTHENTICATION.md) | Standalone auth deep-dive (also inlined in BACKEND_INTEGRATION.md §4) |
+| [ERROR_CONTRACT.md](ERROR_CONTRACT.md) | Standalone error-contract deep-dive (also inlined in BACKEND_INTEGRATION.md §6) |
+| [MAINTENANCE_MODE.md](MAINTENANCE_MODE.md) | Global/tenant/module maintenance-mode contract |
 | [FRONTEND.md](FRONTEND.md) | App structure, routing, i18n, theming, state management, dynamic rendering |
 | [EDITOR.md](EDITOR.md) | The Project Editor: every section, save/publish/draft/reset model |
 | [StaticPages.md](StaticPages.md) | The Static Pages CMS module (the thing that actually serves About/Contacts/etc. today) |
 | [PROJECT-STRUCTURE.md](PROJECT-STRUCTURE.md) | Folder-by-folder tour of `src/app/**` with a worked feature-add example |
 | [ADMIN.md](ADMIN.md) | Admin backoffice: routing, architecture, data sources |
-| [AUTH.md](AUTH.md) | Ed25519 admin auth — prepared, not live; current live gate is Telegram-QR |
+| [PROJECT_STATUS.md](PROJECT_STATUS.md) | **Final Release Candidate status** — frontend/backend/docs/auth/builder/storefront/admin readiness, honest limitations |
 | [FRONTEND-ROADMAP.md](FRONTEND-ROADMAP.md) | Status snapshot refreshed from recent commits — what shipped, what's open |
-| [KNOWN-ISSUES.md](KNOWN-ISSUES.md) | Running list of open/fixed bugs found during manual verification |
-| [TODO.md](TODO.md) | Checklist of everything still remaining, verified against current repo state |
+| [KNOWN-ISSUES.md](KNOWN-ISSUES.md) | Real, reproducible, currently-open frontend bugs only |
+| [PRODUCT_BACKLOG.md](PRODUCT_BACKLOG.md) | Items needing a client/business decision (dark mode, brand colors, page content, etc.) |
+| [FUTURE_FEATURES.md](FUTURE_FEATURES.md) | Nice-to-have, non-blocking future work (Angular 22, bundle splitting, etc.) |
+| [NEXT_PHASE.md](NEXT_PHASE.md) | What happens after backend integration lands |
+| [TODO.md](TODO.md) | Release blockers only — currently empty |
 | [ANGULAR22_PLAN.md](ANGULAR22_PLAN.md) | Angular 22 upgrade feasibility (research only, not yet executed) |
 | [SALES-GUIDE.md](SALES-GUIDE.md) | Plain-language guide for the sales team — what to demo, what's not live yet |
 | [`../DESIGN.md`](../DESIGN.md) | Visual design system: colors, typography, elevation, component specs |
@@ -45,12 +50,13 @@ Read these directly — they're the current source of truth, not one-off reports
 | [`../CHANGELOG.md`](../CHANGELOG.md) | Keep-a-Changelog-format history of shipped features |
 | `docs/architecture/foundation/**` | Enforced ADRs (ADR-001…ADR-010) and standards docs — governance, read directly |
 | `docs/context/**` | Barry Cache's own source-backed memory system — infrastructure, not project documentation, do not edit by hand |
+| `docs/archive/**` | Superseded docs, kept for history only — do not implement against these |
 
-**One topic, one place**: routing lives in FRONTEND.md, not repeated here. Backend contract lives in BACKEND_API.md, not repeated in ADMIN.md. Design tokens live in DESIGN.md, not repeated elsewhere.
+**One topic, one place**: routing lives in FRONTEND.md, not repeated here. Backend contract lives in BACKEND_INTEGRATION.md, not repeated in ADMIN.md. Design tokens live in DESIGN.md, not repeated elsewhere.
 
 ## What's still open
 
-[TODO.md](TODO.md) — checklist of every remaining item across the docs, verified against current repo state.
+[TODO.md](TODO.md) — release blockers only. [PRODUCT_BACKLOG.md](PRODUCT_BACKLOG.md) and [FUTURE_FEATURES.md](FUTURE_FEATURES.md) hold everything else that isn't a blocker.
 
 ## Historical reports
 
@@ -85,4 +91,4 @@ See root `CLAUDE.md` for the full Barry Cache workflow and memory policy.
 - **Documentation**: consolidated (this pass) — 19 one-off reports archived, 2 files renamed for clarity (`PROJECT.md`→`PROJECT_INDEX.md`, `backend/BACKEND-INTEGRATION.md`→`BACKEND_API.md`), 1 duplicate deleted (`RELEASE-NOTES.md` merged into `CHANGELOG.md`).
 - **First client demo**: upcoming — blocked on nothing documentation can fix; see [KNOWN-ISSUES.md](KNOWN-ISSUES.md) for what's still open, starting with the dead-routes finding at the top of this document.
 
-Draft/publish for the Project Editor is still **frontend-only** (localStorage), no backend persistence — the single largest backend gap, see [BACKEND_API.md §6.7](BACKEND_API.md#67-builder--bootstrap-draftpublishvalidate-planned-highest-priority).
+Draft/publish for the Project Editor is still **frontend-only** (localStorage), no backend persistence — the single largest backend gap, see [BACKEND_INTEGRATION.md §1 (Bootstrap: Draft vs Published)](BACKEND_INTEGRATION.md#1-bootstrap) and §8 (Real Backend Implementation Guide).
diff --git a/docs/PROJECT_STATUS.md b/docs/PROJECT_STATUS.md
new file mode 100644
index 0000000..27ea16d
--- /dev/null
+++ b/docs/PROJECT_STATUS.md
@@ -0,0 +1,52 @@
+# Project Status — Final Closeout
+
+Date: 2026-07-26. Branch: `B2B`. Honest snapshot, verified against source — not aspirational.
+
+## Frontend status
+
+**Release Candidate, complete.** `docs/TODO.md` has no remaining blockers. `npx tsc --noEmit` and `ng build` are clean. Manual smoke testing (home, catalog, cart, dialogs) shows zero console errors. All native browser dialogs replaced with shared components, no known broken-image paths, no raw developer jargon in default admin views, no apology-toned empty states. One real (minor) bug remains open — see `docs/KNOWN-ISSUES.md` (Ed25519 admin-auth error codes `session-expired`/`invalid-signature` are currently unreachable; needs a backend body-error-code contract plus a small frontend fix).
+
+## Backend status
+
+**Not started. Fully specified.** `docs/BACKEND_INTEGRATION.md` (4,371 lines) is the single canonical spec: every endpoint, DTO, CRUD contract, auth flow, security posture, error model, upload contract, migration guide, and a 34-item top-to-bottom checklist. Only one domain has a real HTTP implementation today — Categories (`AdminCategoriesApiGateway`). Every other admin domain (Products, Orders, Users, Transactions, Monitoring, Moderation) currently injects its mock gateway class directly and needs a DI token added before it's even swappable. Content-management/builder publish has zero backend call today (in-memory + localStorage only) — the single largest gap.
+
+## Documentation status
+
+Consolidated this closeout. One canonical backend doc (`BACKEND_INTEGRATION.md`) replaces three overlapping ones (archived to `docs/archive/`: `BACKEND_API.md`, `AUTH.md`, `BACKEND_API_REMAINING_WORK.md`). `AUTHENTICATION.md`, `ERROR_CONTRACT.md`, `MAINTENANCE_MODE.md` stand alone as deep-dive references and are also inlined/cross-referenced in the canonical doc. `TODO.md`, `KNOWN-ISSUES.md`, `PRODUCT_BACKLOG.md`, `FUTURE_FEATURES.md` are now cleanly separated by category instead of one mixed checklist. `PROJECT_INDEX.md` (the entry point) updated to reflect all of the above. Not fully swept: some deep architecture ADRs (`docs/architecture/foundation/adr/**`) and a few secondary docs (`FRONTEND.md`, `EDITOR.md`, `ARCHITECTURE.md`, `PROJECT-STRUCTURE.md`, `StaticPages.md`, `ADMIN.md`) still contain old `BACKEND_API.md`/`AUTH.md` references — low-traffic, historical-context docs, not the navigation entry point, left as a known gap rather than touched blindly.
+
+## Authentication status
+
+**Storefront: live.** Telegram/QR session login works end-to-end, is the only way customers authenticate today. **Admin: dormant.** Ed25519 challenge/response admin auth is fully wired client-side (keypair service, signing flow, guard, interceptor) but the interceptor is not registered in `app.config.ts` and the guard is not attached to any route — the flow does not run in production today. No token refresh is implemented for either flow. Full detail: `docs/AUTHENTICATION.md`.
+
+## Builder status
+
+Fully functional as an editor of in-memory/localStorage draft state — homepage sections, widgets, languages, navigation, footer, branding, theme, static pages. **No save/publish ever reaches a backend.** "Publish" today just promotes the local draft signal; nothing is sent over HTTP. This is the single biggest backend gap for going live with real tenant control.
+
+## Storefront status
+
+Feature-complete for the audited surfaces (home, catalog, product detail, cart, checkout UI, wishlist/compare, search, static/CMS pages). Runs entirely against mock data providers. i18n complete across en/ru/hy for customer-facing surfaces (near-parity key counts verified). No native browser dialogs, all dynamic images have a graceful placeholder fallback.
+
+## Admin status
+
+Backoffice UI is built for every domain (dashboard, products, categories, orders, customers, transactions, users, moderation, media, monitoring, analytics) and runs entirely against mock gateways except Categories. Admin route access is gated by `adminAuthGuard`, but that guard performs no role checks today — anyone who passes the (currently Telegram-based) auth gate has full admin access regardless of role; the role model exists in code but isn't enforced yet. Monitoring/Analytics reflect this: Monitoring shows merchant-friendly mock activity; Analytics has no real data source and several values are honestly `null`.
+
+## Known limitations
+
+- One real frontend bug open (Ed25519 auth error codes unreachable — see `KNOWN-ISSUES.md`).
+- Admin role model exists but isn't enforced by any route guard or UI gate yet.
+- No automated test suite exists for the components touched across recent RC passes (none existed before either).
+- Bundle has two large lazy chunks (project-editor 320 kB, catalog-container 126 kB) — not release-blocking, tracked in `FUTURE_FEATURES.md`.
+- 53 local `B2B` commits not yet pushed to `origin` (verified 2026-07-26) — pending explicit go-ahead, a process step not a code blocker.
+- Several product-decision items (dark mode, brand-color contrast, Contacts page content, advanced analytics) are documented but not scheduled — see `PRODUCT_BACKLOG.md`.
+
+## Ready for production?
+
+**No.** No real backend exists. The frontend is ready to be wired to one the moment it exists — see `BACKEND_INTEGRATION.md` and `NEXT_PHASE.md`.
+
+## Ready for backend integration?
+
+**Yes.** This is the primary deliverable of this closeout. Every endpoint, DTO, auth flow, error contract, and migration step a backend engineer needs is documented in `BACKEND_INTEGRATION.md`, with every frontend-undefined decision explicitly flagged rather than guessed.
+
+## Ready for first client demo?
+
+**Yes, with one caveat.** The storefront and builder can be demoed end-to-end against mock data with no visible rough edges from the RC-02/closeout passes. The caveat: admin/backoffice has no role enforcement, so a demo giving anyone admin access effectively gives them full admin access — fine for a controlled demo, worth stating explicitly if the audience will poke at role-based permission claims.
diff --git a/docs/TODO.md b/docs/TODO.md
index 06179ea..aebdf59 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -1,53 +1,7 @@
 # TODO
 
-Checklist of everything documented as open/remaining, verified against current repo state on 2026-07-26 (re-verified against source, not against prior docs).
+No frontend blockers.
 
-## Backend — doing together
+Frontend Release Candidate complete.
 
-- [ ] `bootstrap.json` real content (branding/theme/nav/seo) — default stubs.
-- [ ] Builder bootstrap draft/publish/validate — no backend, editor saves nowhere real.
-- [ ] Backoffice Products CRUD — mock only.
-- [ ] Media upload/delete/replace pipeline — mock only.
-- [ ] Backoffice Orders CRUD + status transitions — mock only.
-- [ ] Backoffice Transactions — mock only.
-- [ ] Backoffice Users/roles/invitations — mock only.
-- [ ] Backoffice Moderation (reviews/reports) — mock only.
-- [ ] Analytics traffic/funnels/heatmaps — no data source at all (FUTURE).
-- [ ] Backend Ready sprint — no real API contract exists yet. In progress: see `docs/BACKEND_INTEGRATION.md` (Backend Finalization Sprint, 2026-07-26).
-
-## UX/design decisions deferred
-
-- [ ] Cart payment modal — still a custom overlay (`.bank-payment-modal`), not `app-dialog` (composition change, deferred).
-- [ ] Brand-color contrast failures (`--border-color`, `--success/warning/error/info-color`) — fails WCAG AA, needs theme-owner sign-off.
-- [ ] `stars.component.scss` hex literal (`#cdd6d5`, line 10) — no token match, needs token-extension decision.
-- [ ] Footer "Contacts" link (`footer-contacts` / `nav.contacts`) — verify static-page content exists for it in bootstrap mock; not re-checked this pass.
-- [ ] Theme Mode (dark/system) selector — no runtime CSS effect, real feature project needed.
-- [ ] Homepage hero-to-categories dead-space gap — mock config artifact, needs real-tenant repro.
-
-## Tooling/infra
-
-- [ ] 2 large lazy chunks (`project-editor` 320kB, `catalog-container` 126kB) — no split found yet.
-- [ ] Angular 22 upgrade — researched, not executed. Plan: ~2-3.5 days, needs barry-cache fix + Node bump first. Explicitly out of scope for current Backend Finalization Sprint.
-- [ ] `git push` of local B2B commits to origin — pending go-ahead.
-
-## Resolved since last pass (2026-07-26), verified against source
-
-- [x] "Featured Products" hardcoded English string — gone, no longer in source.
-- [x] Dashboard "Проблема"/Problem status on 0 products/categories — verified `admin-dashboard.facade.ts`: `unhealthy` only fires on real fetch error (`metrics.status === 'error'`), not on a genuine zero count. Not a bug; prior TODO entry was inaccurate.
-- [x] Backoffice Monitoring raw dev text (`GET /api/products responded 200 in 84ms`, `order.created`) — fixed 2026-07-26 (RC-02 task 3): friendly wording by default, raw detail behind collapsed "Technical details".
-- [x] Cart `clearCart()` native `confirm()` — fixed 2026-07-26 (RC-02 task 4): styled `app-confirm-dialog` (new shared component wrapping existing `app-dialog`).
-- [x] All native `confirm()`/`alert()`/`prompt()` in production UI (12 confirms + 4 alerts across cart, media library, static-pages editor, builder) — fixed 2026-07-26 (RC-02 task 4).
-- [x] `pages/category`, `pages/search`, `pages/item-detail`, `pages/info/**`, `pages/legal/**` (40+ files) — unrouted dead code, deleted 2026-07-25 (RC-02 task 6).
-- [x] `dynamic-renderer/` pipeline "unwired, needs finish-or-delete" — **incorrect premise**, verified 2026-07-25: it's the live homepage rendering pipeline (`HomeComponent` → `WebsiteRuntimeFacade` → `PageRendererService`/`PageResolverService` → `DynamicPageLayoutComponent`). Nothing to finish or delete.
-- [x] ~178 missing `adminXxx.*` translation keys — re-checked 2026-07-26: `en.ts`/`ru.ts`/`hy.ts` key counts are within ~4 of each other (near parity). Prior figure was stale or inaccurate; no large gap exists now.
-- [x] getMainImage() no-photo fallback pointed at a nonexistent `/assets/images/placeholder.svg` — fixed 2026-07-26 (RC-02 task 5): asset created, `onerror` fallback added to every dynamic `<img>`.
-- [x] Footer payment icons (`mir-logo.svg`, `visa-logo.svg`, `mastercard-logo.svg`) referenced in `bootstrap.json` but files didn't exist — site-wide broken image in every page footer. Fixed 2026-07-26: assets created, `onerror` fallback added.
-- [x] Category/subcategory empty states used "Oops!"/"Упс!" apology wording for a normal zero-results condition — fixed 2026-07-25 (RC-02 task 2), then the pages themselves were deleted as dead code (task 6) anyway.
-- [x] No `canDeactivate` guard on `admin/products/:id/edit` — fixed 2026-07-25 (`adminProductDirtyGuard`, mirrors categories).
-- [x] `primeng`/`primeicons` in `package.json` despite no consumer — fixed 2026-07-25 (bumped `barry-cache`, then `npm uninstall`).
-- [x] Builder static-page body editor hidden/mislabeled — fixed 2026-07-25 (RC-01 phase 6).
-- [x] `HeaderConfig.showProfile` toggle — was already removed from the editor template; stale TODO entry, no action needed.
-
-## Done this cycle (for reference, not re-tracked here)
-
-Storefront polish, performance audit (bundle −24%), WCAG 2.1 AA accessibility audit, release-candidate walkthroughs, dead-code cleanup, documentation consolidation, RC-02 release-candidate pass (i18n, empty-state wording, dialog consistency, image placeholders, merchant-friendly Monitoring wording, legacy page deletion — see `docs/RELEASE_REPORT.md`), Backend Finalization Sprint (in progress — `docs/BACKEND_INTEGRATION.md`). Full detail: `docs/FRONTEND-ROADMAP.md`.
+Waiting for backend integration.