# Known Issues

Real, reproducible, currently-open frontend bugs only. Everything that needed a product/business decision moved to `docs/PRODUCT_BACKLOG.md`; everything nice-to-have moved to `docs/FUTURE_FEATURES.md`; everything backend-shaped moved to `docs/BACKEND.md`. Re-verified against source 2026-07-26.

## Open

1. **Ed25519 admin-auth error codes `session-expired` and `invalid-signature` are unreachable — dead UI.**
   `AuthError.code` is documented as routing to a dedicated recovery screen per code
   (`core/auth/models/auth-error.model.ts:1-4`), but `toAuthErrorShape()` in
   `core/auth/services/auth.service.ts:110-118` derives the code for any real
   `HttpErrorResponse` *exclusively* from `authErrorCodeFromStatus(error.status)`
   (line 112) — it never reads the caller-supplied `fallbackCode` parameter for
   real HTTP errors, and never reads any body-level error code from the response.
   `authErrorCodeFromStatus()` (`auth-error.model.ts:21-32`) only ever returns
   `'unauthorized'`, `'forbidden'`, or `'backend-unavailable'` — there is no status
   or body condition anywhere in the codebase that produces `'session-expired'` or
   `'invalid-signature'`. Both screens exist and are wired, but are permanently
   unreachable from any real backend response today.
   - **Fix requires both sides**: a backend that returns a distinguishable
     `error.code` in the response body (see `docs/BACKEND.md` §6 Error Model), and a small
     frontend change to `toAuthErrorShape()` to prefer that body code over the
     blanket status-based fallback.
   - Found: 2026-07-26, Backend Finalization Sprint documentation pass (traced while
     writing `docs/BACKEND.md` §4 Authentication / §6 Error Model).

2. **`NavigationConfig.header` dead editable field — top nav links list has no renderer.**
   The Navigation editor section lets a client edit a list of header nav items
   (`navigation.header`), but `HeaderComponent` never reads `NavigationConfig.header`
   anywhere — its category menu comes from `CategoryFacade` instead. Editing this
   list currently has zero visible effect on the storefront.
   - **Fix requires real feature work**, not a wiring change: rendering a
     configurable top-nav means deciding positioning relative to the existing
     category menu, active-route styling, and whether `children` (dropdowns) are
     supported — out of scope for a mechanical fix.
   - Found: 2026-08-05, Sprint G dead-config sweep (`docs/DEAD-CONFIG-AUDIT.md`).

## Fixed (this cycle)

Condensed — full detail in commit history and `docs/RELEASE_REPORT.md`.

- App-wide query-param routing broken (P0) — `language.guard.ts` legacy redirect percent-encoded query strings into the path.
- Backoffice Categories CRUD broken end-to-end (P0) — wrong provider-mode fallback always picked the real HTTP gateway with no backend present.
- Cart/builder native `confirm()`/`alert()` (16 call sites) replaced with shared `app-confirm-dialog` / toast service.
- `getMainImage()` no-photo fallback and footer payment-icon assets referenced files that didn't exist — both fixed, `onerror` fallback added everywhere.
- Backoffice Monitoring showed raw HTTP/queue/webhook strings by default — now friendly wording with technical detail collapsed behind a `<details>`.
- Category/subcategory empty states used apology wording ("Oops!") for a normal zero-results state.
- `pages/category`, `pages/search`, `pages/item-detail`, `pages/info/**`, `pages/legal/**` (40+ files) were unrouted dead code — deleted.
- `dynamic-renderer/` was believed unwired — verified it's the live homepage rendering pipeline, no action needed.
- `admin/products/:id/edit` missing `canDeactivate` guard — added, mirrors categories.
- `primeng`/`primeicons` unused dependency — removed.
- Builder static-page body editor hidden inside a mislabeled collapsed section — un-hidden, relabeled.
- Several project-editor/admin-categories correctness bugs (footer icon id collisions, features toggle only driving one flag, languages silent duplicate no-op, static-pages slug collision, branding `socialImageUrl` never read, media-picker facade filter leakage between dialogs, categories draft-recovery/drag-reorder bugs, hardcoded locale-tab order) — see git history for the full per-bug list.
- `HeaderConfig.showProfile` dead toggle — wired up (login/logout only, no dropdown), reuses the existing customer Telegram `AuthService`.
- Admin `reports` nav stub — real page (`backoffice/reports`), reuses `AdminAnalyticsFacade` for Sales/Top Products/Marketplace Health cards with CSV export.
- Admin `settings` nav stub — real page (`backoffice/settings`), UI density preference (comfortable/compact), persisted to `localStorage`, applied to admin list tables.
- Admin `documentation`/`help` nav stubs — both wired to real external links (`mailto:` support email, `tenant.documentationUrl`).
- Sprint G dead-config sweep: `footer.logoUrl`, `company.address.street`, `company.contacts.phone`, `catalog.suggestionsEnabled` were editable with no runtime consumer — all four wired up. Full findings table in `docs/DEAD-CONFIG-AUDIT.md`.