| Key | Value |
|-----|-------|
| Date | 2025-11-29 |
| Scope | Full-stack audit (apps/web, apps/api, shared packages, documentation rules) |
| Commands Run | `pnpm type-check`, `pnpm lint`, `pnpm test` |

| Check | Result | Evidence | Notes |
|-------|--------|----------|-------|
| Type-check | ✅ Pass | `pnpm type-check` (Turbo cached run) | TS baselines clean across `@my-roadtrip/*`. |
| Lint | ❌ Fail | `apps/web/src/modules/live/services/liveNavigationService.ts:26`, `apps/web/src/app/components/NotificationCenter.vue:143` | `Function` type usage violates lint rules and multiple props are marked required while also supplying defaults, breaking `vue/no-required-prop-with-default`. |
| Tests | ❌ Fail | `pnpm test` log (`/tmp/pnpm-test.log`) | Backend suites fail to resolve dependencies (OpenAI service import, Bull queue, Testcontainers Redis) and frontend Vitest suites fail because Quasar components are not stubbed. |

| # | Area | Issue | Impact | Evidence | Recommended Action |
|---|------|-------|--------|----------|--------------------|
| 1 | Live Navigation client | `getAuthToken()` returns an empty string, so every REST call injects `Authorization: Bearer ` with no token. | All `/api/live/*` endpoints immediately 401/403, making the entire live session feature unusable. | `apps/web/src/modules/live/services/liveNavigationService.ts:533` | Wire this service into the existing auth store/token refresh flow (or reuse `apiClient`) and ensure tokens refresh before high-frequency calls like position updates. |
| 2 | Architecture compliance | Frontend live navigation store/service installs Firebase Realtime Database listeners (`onValue`) and keeps them open for sessions. Firestore RTDB uses WebSockets under the hood, violating the "NO WebSocket, HTTP polling only" rule defined in `docs/CLI_AGENT_MASTER.md`. | Battery/network impact on mobile, plus architecture drift from the documented CRDT + HTTP polling stack. | `apps/web/src/modules/live/services/liveNavigationService.ts:219`, `apps/web/src/modules/live/stores/liveNavigationStore.ts:425` | Replace Firebase listeners with the existing CRDT/polling stack (IndexedDB + `/api/live/*` poll), or document an explicit exception and update the architecture docs + backend to support polling. |
| 3 | ESLint violations | `liveNavigationService` stores listeners as `Map<string, Function[]>`, triggering `@typescript-eslint/no-unsafe-function-type`, and multiple components mark props as required despite defaults (e.g., NotificationCenter, Discovery/Exploration panels). | CI lint step fails, blocking merges; risk of regressions because prop contracts are misleading. | `apps/web/src/modules/live/services/liveNavigationService.ts:26`, `apps/web/src/app/components/NotificationCenter.vue:143`, `apps/web/src/modules/map/components/panels/DiscoveryPanel.vue:5` | Type listener signatures explicitly (`Map<string, Array<() => void>>`) and mark props optional when `withDefaults` supplies fallbacks. |
| 4 | Backend AI tests | Vitest cannot import `services/openai.service` (missing `.ts` extension in vitest resolver) and the Bull queue is instantiated during test bootstrap, calling `aiQueue.on` before mocks are applied. | 60+ backend tests fail (`OpenAIService`, `AIController`, `AIService`, `logger` suites). | `apps/api/src/services/__tests__/openai.service.test.ts` error in `/tmp/pnpm-test.log`, `apps/api/src/core/queue/ai-queue.ts:94` | Use explicit `.ts` extension (or `tsconfig` path alias) in tests and guard queue side effects (`if (process.env.VITEST)`), or provide a mocked queue when `NODE_ENV === 'test'`. |
| 5 | Planner integration tests | The Vitest suite spins up `testcontainers` Redis (`RedisContainer().start()`), which fails without Docker, and the Fastify app reference is undefined when cleanup runs. | Entire planner integration suite is skipped/failing locally, so regressions in CRUD endpoints go unnoticed. | `apps/api/src/modules/planner/__tests__/planner.integration.test.ts:17` | Provide a lightweight Redis mock for CI/local runs, gate container usage behind an opt-in flag, and null-check the Fastify instance in `afterAll`. |
| 6 | Frontend unit tests | `SyncStatusBadge` and `OfflineIndicator` tests mount Quasar components without installing the Quasar plugin or stubbing `q-*` components, so assertions like `wrapper.find('.q-icon')` always fail. | `@my-roadtrip/web:test:unit` fails outright; none of the new offline/sync components are actually covered. | `apps/web/src/shared/components/__tests__/SyncStatusBadge.test.ts:24`, `apps/web/src/shared/components/OfflineIndicator.vue:8` | Install Quasar within the Vitest setup file or stub required components (e.g., via `global.stubs`). Adjust expectations to assert component output rather than DOM class names tied to Quasar internals. |

| Risk | Description | Files Affected | Priority |
|------|-------------|----------------|----------|
| Live navigation auth gap | Feature currently bypasses auth and depends on Firebase RTDB sockets with no documented offline fallbacks. | `apps/web/src/modules/live/services/liveNavigationService.ts`, `apps/web/src/modules/live/stores/liveNavigationStore.ts` | 🔴 |
| Test infrastructure | Backend suites depend on Docker + live queues; frontend suites depend on Quasar runtime; neither provide fallbacks. | `apps/api/src/modules/*/__tests__`, `apps/web/src/shared/components/__tests__` | 🔴 |
| Lint/prop contract drift | Multiple components declare required props despite defaults, risking consumer misuse. | `apps/web/src/app/components/NotificationCenter.vue`, `apps/web/src/modules/map/components/panels/*.vue`, `apps/web/src/modules/live/components/*.vue` | 🟠 |

| Module | Frontend Evidence | Backend/Infra Evidence | Health |
|--------|-------------------|------------------------|--------|
| Planner | Mobile hero, AI triggers, and stage progress chips are implemented in `apps/web/src/modules/planner/pages/PlannerPage.mobile.vue:1`-`120`. | Firestore-backed CRUD tested via controller/service stack referenced in `apps/api/src/modules/planner/__tests__/planner.integration.test.ts:1`-`120` (currently skipped when Docker is unavailable). | ✅ Features rich, ⚠️ integration tests flaky due to Redis container dependency. |
| Map | Mobile MapPage renders live speed/ETA context bar, MapView bindings, and live chips (`apps/web/src/modules/map/pages/MapPage.mobile.vue:1`-`120`). | Mapbox/Weather services still frontend-only; no backend counterpart, aligning with table in `docs/REFERENCE.md` that marks map backend as ❌. | ✅ UI complete, ⚠️ weather/traffic overlays rely on frontend tokens only. |
| Live Navigation | Store wires session, participants, chat, telemetry, and emergency flows (`apps/web/src/modules/live/stores/liveNavigationStore.ts:100`-`210`), but Firebase listeners + missing auth token keep it unstable. | Fastify controller exposes create/list/join/end routes with auth guard (`apps/api/src/modules/live/liveNavigation.controller.ts:1`-`120`). | ⚠️ Feature breadth is there, but real-time stack conflicts with “No WebSocket” rule and auth is broken. |
| Billing | Mobile subscriptions page covers hero, plan toggle, comparison table, and CTA wiring (`apps/web/src/modules/billing/pages/SubscriptionsPage.mobile.vue:1`-`120`). | Billing service orchestrates Stripe, quotas, referrals, cache, and plan sync (`apps/api/src/modules/billing/billing.service.ts:1`-`120`). | ✅ Full stack implemented; dependent on Stripe env vars at runtime. |
| Shared Types | Live/social payloads aligned across FE/BE via `packages/types/src/live.types.ts:1`-`120`. | Same file used in API controllers/services for serialization. | ✅ Strong contract coverage; keep types in sync when refactoring live features. |
