docs(backlog): update with PDF/react-email/scan-compress/a11y wins + remainder

Adds a new §G (dependencies / audit roadmap) documenting what landed in the 2026-05-12 session (PDF stack overhaul, react-email migration, browser-image-compression, axe-core) and what's left in roughly decreasing impact-per-hour order. Each remaining item gets an estimate, a "pattern proven?" note, and a one-line action plan so a future session can resume without re-reading the entire audit doc. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-12 21:25:03 +02:00
parent a52e92ae3e
commit 63220ad072
1 changed files with 66 additions and 6 deletions
--- a/docs/BACKLOG.md
+++ b/docs/BACKLOG.md
@@ -4,12 +4,13 @@
 asking "what's left to build/fix?". Items are grouped by source doc;
 each entry links back to the original spec for full context.

-Last updated: 2026-05-08 (second non-Documenso sweep — storage-proxy
-port-binding, system_settings NULLS NOT DISTINCT + dedup migration,
-response-shape standardization, parseBody migration, custom-field merge
-tokens, /api/v1/files companyId+yachtId filter, Company Documents tab,
-file-upload zone wired for company/yacht targeting). Documenso phases
-2-7 stay back-burnered per user.
+Last updated: 2026-05-12 (PDF stack overhaul shipped: react-pdf brand
+kit + port logo upload + 4 reports + 3 record exports + parent-company
+expense + pdfkit brand header + invoice removal + tiptap-to-pdfme
+deletion + unpdf for berth-parser tier-2; pdfme deps removed.
+Remaining 7 react-email templates ported. browser-image-compression
+wired into scan-shell. @axe-core/playwright smoke suite added.).
+Documenso phases 2-7 stay back-burnered per user.

 ---

@@ -128,6 +129,65 @@ instances, or cross-cutting refactors:

 ---

+## G. Dependencies / audit roadmap (post-PDF-overhaul)
+
+**Source:** [`docs/AUDIT-2026-05-12.md`](./AUDIT-2026-05-12.md) §§ 34-36 +
+[`docs/superpowers/specs/2026-05-12-pdf-stack-overhaul-design.md`](./superpowers/specs/2026-05-12-pdf-stack-overhaul-design.md).
+
+What's done (2026-05-12 session):
+
+- ✅ **PDF stack overhaul** — `@react-pdf/renderer` + brand kit + port logo upload pipeline; 4 reports + 3 record exports + parent-company expense ported; pdfme uninstalled; pdfkit retained for streaming expense PDF (now with shared brand-header). Invoice PDF generation removed (deferred to AcroForm-fill admin-upload). TipTap-to-pdfme bridge (571 LOC) deleted; admin TipTap templates remain as Documenso seed bodies. `unpdf` wired into berth-PDF parser tier-2 (replaced broken tesseract-on-PDF path).
+- ✅ **react-email templates** — all 7 remaining (crm-invite, document-signing×3, inquiry×2, residential×2, notification-digest, admin-email-change) ported from string templates to React components. Public API surface now `async`. The whole email template directory is uniformly react-email.
+- ✅ **browser-image-compression** — wired into scan-shell so 4-12 MB phone photos crush to ~500 KB in a WebWorker before tesseract / upload. Massive mobile bandwidth + battery + perceived-latency win.
+- ✅ **@axe-core/playwright** — smoke spec runs WCAG 2.1 A/AA against 6 main pages; CI fails on new critical/serious violations.
+
+Remaining (in roughly decreasing impact-per-hour order):
+
+| Item                                          | Estimate            | Pattern proven?                  | Notes                                                                                                                                                                                                                                                                                                                                    |
+| --------------------------------------------- | ------------------- | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **ts-pattern in remaining switch sites**      | ~2h                 | Yes (Documenso webhook)          | `search.service.ts` (19 cases) · `client-restore.service.ts` (12 cases) · `recently-viewed/route.ts` (10 cases) · `custom-fields/[entityId]/route.ts` (10 cases). Each site swap follows the Documenso webhook pattern: `.with('foo', …).exhaustive()`; new union members fail the build instead of silently dropping. ~30 min per site. |
+| **p-limit in remaining mass-op services**     | ~3h                 | Yes (email-compose, doc-signing) | `brochures.service` (S3 reads), `backup.service` (gdpr fan-out), `documents.service` (mass-archive), `berth-pdf.service` (S3 presign loop), `custom-fields.service` (DB upsert fan-out), `notifications.service` (user fan-out). Bounds peak concurrency; prevents prod outages on bulk operations. ~30 min per site.                    |
+| **drizzle-zod remaining ~28 CRUD validators** | ~3-4h opportunistic | Yes (tags, brochures)            | Each validator file migrated as the file is touched. Single-line `createInsertSchema(table)` replaces hand-rolled zod object. Drift class is eliminated.                                                                                                                                                                                 |
+| **Centralize date formatting helper**         | ~2-3h               | No                               | 44 hand-rolled `.toLocaleString()` sites scattered across services + components. Needs `formatDate(date, fmt, tz)` backed by existing `date-fns`. Optionally add `date-fns-tz` for proper TZ-aware formatting (audit flagged latent bugs).                                                                                               |
+| **@tanstack/react-virtual in DataTable**      | ~2-3h               | Package installed (audit C1)     | Refactor `src/components/ui/data-table.tsx` to virtualize rows. Risk: sticky-header + sort + selection coupling. Best done when DataTable is otherwise being touched. 5000-row client list scroll perf win.                                                                                                                              |
+| **PWA assets** (per `MEMORY.md`)              | ~30 min             | N/A                              | Add `public/icon-192.png`, `public/icon-512.png`, `public/icon-512-maskable.png` before shipping Phase B PWA scanner.                                                                                                                                                                                                                    |
+
+Tier 2 polish (each 30 min – 1 h, all opt-in):
+
+- `embla-carousel-react` + `yet-another-react-lightbox` — berth / yacht photo galleries.
+- `react-resizable-panels` — docs hub sidebar resize.
+- `@use-gesture/react` — kanban swipe on mobile, pinch-zoom on photos.
+- `use-debounce` — replace the in-tree `useDebounce` hook (~13 LOC) + add `useDebouncedCallback` ergonomics at the 8 picker components.
+- `fast-deep-equal` — DataTable memo comparator + RQ `select` deep-equal.
+
+Decisions / parked:
+
+- `@upstash/ratelimit` — replace 4 hand-rolled rate limiters (audit Tier 2 candidate).
+- `next-safe-action` — pilot on a new form first.
+- `@sentry/nextjs` — needs SaaS-dep decision.
+- `@tiptap/core` upgrade — needs product decision on rich notes.
+- `pdfjs-dist` / `@react-pdf-viewer/core` — in-browser PDF preview in docs hub (paired with PDF stack overhaul if revived).
+- `@faker-js/faker` — better seed data (dev-only).
+- `msw` — deterministic external-service mocking in integration tests.
+- `next-pwa` / `@serwist/next` — PWA assets pending per MEMORY.md.
+- `next-intl` — no current i18n target.
+- `posthog-js` — analytics scope decision.
+
+Major deferrals from §34 of audit:
+
+- **Next 15 → 16** — codemod handles it; wait 2-4 weeks for field bugs to surface (touches `middleware.ts` → `proxy.ts` + custom server).
+- **Tailwind 3 → 4** — focused-afternoon project; visual regression risk across every screen.
+- **eslint 9 → 10** — locked to next 16.
+- **archiver 7 → 8** — no `@types/archiver@8` published; skip indefinitely.
+
+Future PDF-related work (carry-over from §A of the PDF overhaul spec):
+
+- **AcroForm-fill admin-uploaded PDF templates** (~1 week solo): new `pdf_templates` table + admin upload UI + field-mapping editor + generalize `fill-eoi-form.ts` into a reusable `fillAcroForm()` utility. Reinstates the invoice PDF path (and any future customer-facing standardized doc).
+- **Port brand color tokens** (~2 h): admin sets brand color → flows into the PDF brand kit accent.
+- **Optical receipt-photo rotation/deskew** (~half day): auto-rotate phone-upload receipts that EXIF misses.
+
+---
+
 ## F. Historical audit docs (mostly resolved)

 These dossiers drove the audit-fix commit waves on 2026-05-05/06. Items