Gaps found while mapping

These came out of reading every screen for its states. Each is a static read of the source at the commit the map was generated from; confirm on a device before fixing.

Mobile appCopy Anchor Link

1. Develop has no Home notification prompt; it is offered after an order. The feature branch moves it to Home.
2. Deleted or suspended accounts arriving via Google, Apple or mid-session are signed out with no message.
3. Social sign-in errors show raw SDK strings; phone errors are normalised to friendly copy.
4. Restart App on the crash screen, and automatic critical recovery, sign the user out.
5. Quiz resume restores answers but not the step; beauty profile and Home card use different completion checks.
6. No forced update or maintenance mode exists; both update prompts can be dismissed for 7 days.
7. Offline search, marketing, avatar and beauty profile screens show a loader or nothing, with no error state.
8. Rejected deep links are silent; sign-in code and details screens cannot be deep linked.
9. Most browse, PDP, search and wishlist copy is hardcoded English, so ms and ar locales stay English.
10. Shop and PDP error states never render (error is always null); crashes fall to error boundaries.
11. PDP quantity stepper allows 99 but each add silently clamps to 10 with no message.
12. Out of stock PDP shows greyed buttons only. No Sold out label or Notify me.
13. Resume checkout button does not resume; it returns early with the lock toast.
14. Shopify close, error and present failures are silent; no toast, bag just unlocks.
15. Buy now has no sign-in guard or completion callback; guests get Checkout failed.
16. No-voucher users cannot reach the promo input; Shop lists sold out, Search hides it.
17. Refund, partial refund and void never reverse stamps or shake vouchers; only orders/cancelled does
18. Cancelled orders keep their +N Activity row and a stamp row that still says You earned N stamps
19. No push or inbox notice for shipping, delivery, refund, cancel, stamps or vouchers; only order_confirmation
20. Shipped orders with no tracking number can never be marked received and stay Shipped
21. Checkout-attributed orders show in the list but fail Mark as received and Reorder with Order not found
22. Rate & Review opens the first item's product page; hasReviewed is hard-coded false
23. Push tap ignores hasDetailContent, so detail notices only open from the inbox row
24. Unlinked or shipping-phone-only orders are invisible; voucher expiry reminder has no cron caller
25. Most Profile copy is hardcoded English; Bahasa Malaysia only translates menu rows and a few features.
26. Delete Account says data is permanently removed, but the backend only soft-deletes; success false is ignored.
27. Joined date in ProfileHeaderCard never renders because Profile omits createdAt.
28. Remove-from-bag has no confirmation, while address delete, block user and mark received do.
29. Voucher list error view and 10 of 12 LoyaltyEmptyState types are unreachable today.
30. App update is dismissible for 7 days; no force update, maintenance screen or global offline banner exists.
31. select-avatar title differs between layout and screen, and its empty state tells users to ask an admin.
32. Two toast stacks (HeroUI toast and flash-message) are in use, so toast styling varies. Static read only, not device-verified.
33. Capture audit 2026-10-30: test-account names, emails and phone numbers are approved for screenshots; voucher and referral codes remain masked during import.
34. Observed on dev during capture: wishlist heart can navigate to the product instead of showing the removed toast; iOS notification-preference and invalid-promo toasts can render behind native sheets.
35. Observed on dev during capture: closed-account OTP verification can remain on Checking code while signed out underneath. Account creation can show a notification pre-prompt; the prior no-notification-ask description is inaccurate.
36. Capture continuation 2026-10-30: device connection recovered; 35 Android and two iOS screenshots captured sequentially, visually reviewed and imported. Failed captures were excluded.
37. Capture continuation 2026-10-30: Android invalid-promo error toast was not visible over the native voucher sheet in two attempts. Signup details appeared after OTP but the cold-relaunch capture timed out; that branch remains unverified. QR claim outcomes need camera QR input unavailable in current device controls.
38. Capture cleanup 2026-10-30: QA addresses restored (two, original default), reviewer unblocked, Nur Demo active, temporary developer phone restored, details-test profile fields restored and onboarding marked offered. Address and beauty row ids/timestamps changed; an empty routine list may now be explicit. Android permission fixtures reset. iOS simulator notification permission remains denied for the captured blocked state.

DashboardCopy Anchor Link

1. Route gate is client only. No middleware; Convex is the real boundary.
2. Suspended or banned staff keep the full shell. Server returns empty data, no dedicated screen.
3. Notification writes are admin-only twice over: AdminOnly wraps Send, Schedule, Save draft, flow and template actions in the UI, and every write mutation calls requireAdminAccess. A dashboard user can read Messages, Flows and Templates but not change them.
4. Webhook buttons gate on admin; the matrix says super_admin and is never read.
5. Order detail for dashboard role shows Order not found toast and redirects, never AccessDenied.
6. /dashboard/users/new and /dashboard/ratings/[id] have no inbound links. Users/new is an explainer.
7. Sign-up lands apps users on AccessDenied with an empty sidebar. No pending-approval screen.
8. Raya and Pool code generation is paused (GENERATION_PAUSED); Create pool is a dead end that still creates the campaign.
9. Raya delete dialog says permanent but only deactivates; pool detail has the honest two-mode dialog.
10. Issuing with Shopify writes off still shows Issued voucher X, but no Shopify code exists.
11. ShopifyWriteBanner is missing on revoke, reissue, template edit and sync, Award Stamps and Delete Voucher.
12. Award stamps limits disagree: dialog 10, popover 5, backend 100; awards can mint live Shopify codes.
13. Template Use in Campaign and Quick Actions Sync do nothing; the campaign form loadTemplate is a stub.
14. Both not-found.tsx files for campaigns and carousel are dead; views toast and redirect instead.
15. access-control maps /duit-raya but the real route is /raya-campaign; the route-to-feature map misses it.