docs: full feature-gap audit — web UI exposes ~20% of the backend #4069

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/AlecRae.com/pull/62

Summary

Full four-track code audit of the monorepo (backend route mounting/auth, web UI coverage, non-web apps + services, code quality vs CLAUDE.md standards), compiled into docs/audits/2026-06-11-feature-gap-audit.md and registered as known issues #27–#30 in CLAUDE.md.

Headline

The backend is genuinely ~complete — 95/96 route files mounted, all protected routes have auth + rate limiting, no mock data anywhere, all 12 services are real implementations. The gap is the web frontend: the sidebar exposes 10 items while the API ships ~96 route groups; 15+ feature domains have zero web UI, 14 finished components are orphaned, and 4 inbox handlers (AI reply, AI summarize, command palette, focus mode) are literal no-ops.

Key findings

• #27 (HIGH): Web UI exposes ~20% of backend; 7 API clients defined but never called
• #28 (HIGH): In-memory store regression — 7 stores lose user data on restart (snooze undo, calendar, ai-rules, programs, import jobs, voice messages, phishing reports)
• #29 (MEDIUM): 13 backend stub endpoints (R2 presigned uploads, docs AI assist, OCR, enrichment…); warmup.ts unmounted; unencrypted token TODO
• #30 (MEDIUM): ~7 e2e test files for 310+ endpoints; 11 zero-test workspaces; 28 production as unknown as, 135 production console.log
• Extra production blockers: .dev hostname defaults beyond known issue #26 (TRACKING_BASE_URL, MTA SMTP_HOSTNAME); loose env handling (no fail-fast validation)

The report ends with a priority-ordered fix plan (§10): wire orphans/no-ops first, expand sidebar IA, migrate in-memory stores, fix .dev hosts, env validation, finish stubs, tests.

Docs check passes (bun run docs:check — 49/49 stamped).

https://claude.ai/code/session_013mN1D3m3P95nke5gceVegG

Generated by Claude Code