{
  "spec": "settings-module+app-shell",
  "audited_at": "2026-06-12",
  "findings": [
    {
      "id": "sm-001",
      "severity": "P0",
      "status": "open",
      "summary": "/profile route not registered; shell nav links to a dead path with no profile page component in the main app",
      "evidence": "apps/zync-app/src/routes/index.tsx:97-159 — moduleRoutes lists dashboard, settings/*, invoices, etc.; no 'profile' path. apps/zync-app/src/shell/UserMenu.tsx:79 — navigate('/profile'). apps/zync-app/src/shell/Sidebar.tsx:349 — SidebarNavItem to '/profile'. Closest profile UIs are portal-only (apps/zync-app/src/portal/pages/Profile.tsx) and unregistered staff page (apps/zync-app/src/routes/staff/profile.tsx at /staff/profile, not wired in router)."
    },
    {
      "id": "sm-002",
      "severity": "P1",
      "status": "open",
      "summary": "GET/PATCH /api/settings/business not implemented; business settings mounted at /api/settings/account instead",
      "evidence": "apps/zync-api/src/routes/index.ts:369 — routes.route('/settings/account', accountSettingsRoute); no settings/business mount. apps/zync-api/src/routes/settings/ — 22 handlers, no business.ts. apps/zync-api/src/routes/settings/account.ts:3-7 — GET/PATCH /api/settings/account with name, slug, timezone, logo_url only."
    },
    {
      "id": "sm-003",
      "severity": "P1",
      "status": "open",
      "summary": "Spec profile API surface (/api/profile/*) absent; only portal customer profile and session identity /api/auth/me exist",
      "evidence": "apps/zync-api/src/routes/portal/index.ts:95 — portalRouter.route('/profile', portalProfileRoutes) (customer portal, not staff app). apps/zync-api/src/routes/auth/me.ts:15 — GET /api/auth/me returns session identity, not profile CRUD/password/sessions/notifications. Grep apps/zync-api/src for /api/profile and /api/me/profile returns no staff profile handlers. apps/zync-app/src/routes/staff/profile.tsx:74 — UI calls PATCH /api/me/profile but no matching API route is registered."
    },
    {
      "id": "sm-004",
      "severity": "P1",
      "status": "open",
      "summary": "SettingsShell component and SETTINGS_NAV manifest not present; settings hub is an emoji card grid, not spec two-pane shell with canonical nav tree",
      "evidence": "Grep apps/zync-app/src for SettingsShell and SETTINGS_NAV — no matches. apps/zync-app/src/routes/settings/index.tsx:27-35 — CATEGORIES card hub linking to /settings/account, /settings/team, etc. apps/zync-app/src/modules/settings.tsx:95-106 — lazy Route shell per sub-page; no shared settings sidebar manifest from spec Settings Navigation Manifest table."
    },
    {
      "id": "sm-005",
      "severity": "P1",
      "status": "open",
      "summary": "Change-email schema columns pending_email, pending_email_token, pending_email_expires_at missing from users table",
      "evidence": "packages/db/src/schema/users.ts:11-31 — users columns are id, email, passwordHash, name, avatarUrl, emailVerifiedAt, status, createdAt, twoFactor*, lastLoginAt; no pending_email*. Repo-wide grep pending_email in packages/db — no matches."
    },
    {
      "id": "as-001",
      "severity": "P0",
      "status": "fixed",
      "summary": "/dashboard route registered as alias redirecting to canonical home at /",
      "evidence": "apps/zync-app/src/routes/index.tsx:98-100 — { path: 'dashboard', element: <Navigate to=\"/\" replace /> }. apps/zync-app/src/shell/nav-model.ts:48 — Dashboard nav item to '/dashboard' now resolves via redirect."
    },
    {
      "id": "as-002",
      "severity": "P0",
      "status": "fixed",
      "summary": "Tenant switch still hard-reloads to /dashboard, which now redirects to home; switch flow lands on dashboard content",
      "evidence": "apps/zync-app/src/shell/TenantSwitcher.tsx:92 — window.location.assign('/dashboard'). apps/zync-app/src/routes/index.tsx:99 — /dashboard → Navigate to=\"/\" replace. Prior audit P0 (blank /dashboard) resolved by dashboard alias."
    },
    {
      "id": "as-003",
      "severity": "P0",
      "status": "open",
      "summary": "Sidebar and user menu profile links target /profile but no profile route is registered (same gap as sm-001)",
      "evidence": "apps/zync-app/src/shell/Sidebar.tsx:347-350 — User avatar SidebarNavItem to '/profile'. apps/zync-app/src/shell/UserMenu.tsx:78-83 — Profile menu item navigate('/profile'). apps/zync-app/src/routes/index.tsx:97-159 — no profile path in moduleRoutes."
    }
  ]
}