**Last Updated:** May 2026 — Booking edit modal for /today page, 306/308 tests passing
**Status:** Living backlog — add to this as gaps are discovered

---

# 🟢 Local Gaps — Can Fix Now

No external dependencies. No paid services. No API keys needed.

## P0 — Critical (Fix Now)

| #   | Gap                                                  | Effort   | Area     | Notes                                                                                                                                                                                 |
| --- | ---------------------------------------------------- | -------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1   | ~~`DELETE /api/user/account` is a no-op~~ ✅          | S (1-2h) | Backend  | Wired to `anonymize_user()` for registered users and `delete_guest_user()` for guests. CardDAV contact deleted best-effort.                                                           |
| 2   | ~~**WalkInCreateModal guest booking errors out**~~ ✅ | S (1-2h) | Frontend | Guest creation now fires at submit time in both walk-in and call-in flows. Phone defaults to +447700900000 if left blank.                                                             |
| 3   | ~~**ApprovalModal decline/cancel stub**~~ ✅          | S (2-3h) | Frontend | `handleDecline()` now calls `POST /api/admin/bookings/{id}/cancel`. Backend sets status to `we_cancelled`, acknowledges pending notification, creates cancelled_booking notification. |
| 4   | **CurrentAppointment action stubs**                  | M (1d)   | Frontend | `handleEdit()` ✅ — now opens `EditBookingModal` for service management. `handleTakePayment()` ⚠️ blocked on Square. `handleExtend()`, `handleCancel()` — dead buttons.                                                                                        |

## P1 — High

| #     | Gap                                                      | Effort   | Area       | Notes                                                                                                                                                                                                                                                                                                          |
| ----- | -------------------------------------------------------- | -------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ~~5~~     | ~~**Admin notification panel**~~ ✅                             | ~~M (1-2d)~~ | ~~Frontend~~   | ~~Backend fully wired (GET/acknowledge). No frontend UI to display notifications. Admin has no visibility into pending bookings, cancellations, no-shows.~~ Two-tier system live: `new_booking` (all) + `pending_booking` (notes/today). Priority ordering, bell icon, `/notifications` page, acknowledge flow, enriched responses.
| 6     | **Reservation/anonymization cron**                       | S (2-3h) | Backend    | `CleanupOldReservations()` and `AnonymizeStaleGuestAccounts()` only fire on availability fetch. If no one fetches availability, expired reservations persist and stale guests aren't anonymized. Should be a background ticker in `main.go`.                                                                   |
| 7     | **GDPR data export endpoint**                            | M (1d)   | Backend    | `export_all_user_data()` SQL function exists (JSON export). No Go handler wired. Required for GDPR Article 15 SAR requests.                                                                                                                                                                                    |
| 8     | **VAT/Tax export endpoints**                             | M (1-2d) | Backend    | `get_vat_return_data()`, `export_sales_transactions()` SQL functions exist. No admin API to trigger them. Needed for HMRC compliance.                                                                                                                                                                          |
| ~~9~~ | ~~**Walk-in guest reservation → booking transition**~~ ✅ | S (1h)   | Frontend   | Done — guest accounts created at submit time, reservation system uses explicit reservation_type field, both walk-in and call-in use 15min TTL.                                                                                                                                                                 |
| 10    | **Password reset flow not wired to frontend**            | S (2-3h) | Frontend   | Backend has `/api/verify/generate` and `/api/verify/check` endpoints. Login page has no "forgot password" link or form.                                                                                                                                                                                        |
| 11    | **Email verification flow not wired to frontend**        | S (2-3h) | Frontend   | Users register with `unverified_email` role. No UI to enter verification code or resend code. `+layout.svelte` has alert-based prototype.                                                                                                                                                                      |
| 12    | **Booking cancellation from user account**               | S (2-3h) | Frontend   | UserBookingModal shows booking details but no cancel button. Users must call/email to cancel. Backend endpoint exists (`DELETE /api/bookings/{id}`).                                                                                                                                                           |
| 13    | ~~**Booking rescheduling for users**~~ ⚠️                | M (1-2d) | Full-stack | Backend fully wired (request/approve/deny + time_blocker reservation). Frontend re-validation on submit implemented. **Remaining:** Admin UI to view/approve/deny edit requests — consider extending existing Pending Approvals panel. User notification on approve/deny tracked as TODO (blocked on E5).      |
| 50    | **Admin UI for edit request approval/denial**            | M (1-2d) | Frontend   | Backend endpoints exist: `GET /api/admin/bookings/{id}/edit-requests`, `POST .../approve`, `POST .../deny`. Needs UI to display pending requests with proposed vs original time, approve/deny buttons. **Consider:** Extend existing Pending Approvals panel on Today page rather than building separate page. |

## P2 — Medium

| #      | Gap                                                        | Effort       | Area           | Notes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| ------ | ---------------------------------------------------------- | ------------ | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 14     | ~~`delete_guest_user()` SQL function missing~~ ✅           | S (1h)       | DB             | Created next to `anonymize_user()` in init-script.sql. Called by `DeleteAccountHandler` for guest users.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| ~~15~~ | ~~**User notification preferences UI**~~ ✅                 | ~~S (2-3h)~~ | ~~Frontend~~   | ~~DB table `user_notification_preferences` exists with email/sms/push flags. No settings page to toggle them.~~ GET/PUT endpoints wired. Toggle section in /account Admin tab. Email, SMS, Browser push channels. Auto-save on toggle.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| 16     | **One-off custom services**                                | M (1-2d)     | Full-stack     | Admin can't create single-use services outside the catalog. Every custom job (bridal party, special request) must be added to permanent service list.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| 17     | **One-off exceptional hours**                              | M (1d)       | Full-stack     | Single-day overrides (dentist appointment, afternoon off) require creating a full exceptional group. Should support one-off date blocks without group overhead.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| 18     | ~~**HSTS header**~~ ✅                                      | XS (15min)   | Backend        | Added as a TODO-comment in the security headers middleware. Will be uncommented when HTTPS is enabled in production.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| 19     | ~~**Referrer-Policy header**~~ ✅                           | XS (15min)   | Backend        | Added as a TODO-comment in the security headers middleware. Will be uncommented when ready for production.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| 20     | **Business settings management UI**                        | M (1-2d)     | Full-stack     | `business_settings` table exists (VAT registration, business name, etc.). No admin page to configure. Changes require direct SQL.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| 21     | **Referral system UI**                                     | M (1-2d)     | Full-stack     | `user_referrals` table exists. Users can't see their referral code or track uses. Admin can't manage referral campaigns.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| 22     | **Analytics endpoints**                                    | M (1-2d)     | Backend        | `handlers/admin/analytics.go` is 1 line. `get_monthly_business_summary()`, `get_sales_totals()` SQL functions exist. No admin dashboard stats.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| 23     | ~~**console.log debug statements**~~ ✅                     | XS (15min)   | Frontend       | Removed from BookingFlow.svelte and ImageUpload.svelte.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| 24     | ~~**Alert-based prototype UX**~~ ✅                         | XS (30min)   | Frontend       | Replaced all `alert()` calls with `toast.success/error/info` from svelte-sonner.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| ~~25~~ | ~~**No customer relationship view**~~ ✅                    | M (1-2d)     | Frontend       | **Implemented May 2026.** New `GET /api/admin/users/{id}/relationship` endpoint returns: total spend (from completed payments), total visits, first/last visit dates, avg visits/month, top 5 most booked services, notes history. New `user_notes_history` table tracks note changes. UserModal shows "Customer Relationship" section between Loyalty & Referrals and Privacy & Consent.                                                                                                                                                                                                                                                                                                                                                                                           |
| 26     | **CSV/Excel export for bookings/payments**                 | M (1d)       | Backend        | Admin can't export data for accounting software. SQL functions exist but no endpoint to download as CSV.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| 27     | ~~**Graceful shutdown**~~ ✅                                | S (1h)       | Backend        | Added signal handling for SIGTERM/SIGINT with 15-second shutdown timeout in main.go.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| 28     | ~~**Health check endpoint**~~ ✅                            | XS (15min)   | Backend        | Added `GET /api/health` returning overall status plus DB, S3, Square, and frontend service statuses.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| 29     | **API documentation**                                      | M (1-2d)     | Backend        | No OpenAPI/Swagger spec. No generated docs. New developers must read code to understand endpoints.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| 30     | **XSS input sanitization**                                 | S (2-3h)     | Backend        | Backend validates format (regex, length) but doesn't sanitize HTML entities. Stored XSS risk in `notes`, `name`, `description` fields.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| 31     | **Per-user rate limiting**                                 | M (1d)       | Backend        | Rate limiter is IP-based. Authenticated users could abuse from multiple IPs. Should track by user ID + IP. Pure Go — no Redis needed for single-instance.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| 32     | **CSRF protection**                                        | S (2-3h)     | Backend        | SvelteKit handles some CSRF for its own forms, but direct API calls to `/api/*` bypass it. Consider double-submit cookie or SameSite cookies.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| 33     | **Begin button (Today page)**                              | S (2-3h)     | Full-stack     | Manual start for early arrivals. Gray out if >3hrs away. Currently auto-infer only.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| 34     | **Auto lunch protection**                                  | M (1d)       | Backend        | Block bookings that remove lunch break. 1h customer auto-block, 30min admin with warning.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| 35     | ~~**Walk-in slot blocking**~~ ✅                            | S (1-2h)     | Frontend       | **Resolved May 2026.** `WalkInBooking.svelte` reserves slot via `POST /api/admin/bookings/reserve` (15-min TTL) before opening `WalkInCreateModal`. Backend `AdminReserveSlotHandler` creates `time_blocker` entry with `RESERVATION:admin:walkin:*` description, blocking concurrent bookings. Minor gap: reservation time_blocker not deleted after booking creation (relies on TTL expiry via `CleanupOldReservations`).                                                                                                                                                                                                                                                                                                                                                         |
| ~~36~~ | ~~**No idempotency keys for bookings**~~ ✅                 | S (2-3h)     | Full-stack     | **Implemented May 2026.** `idempotency_key VARCHAR(64) UNIQUE` column added to bookings table. Both `POST /api/bookings` and `POST /api/admin/bookings` extract `Idempotency-Key` header, check for existing booking with that key, return existing booking with 200 if found (no duplicate). Frontend BookingFlow.svelte and WalkInCreateModal.svelte generate UUID via `crypto.randomUUID()`, reuse same key on retry.                                                                                                                                                                                                                                                                                                                                                            |
| 37     | **No booking conflict detection for users**                | S (2-3h)     | Backend        | Users can theoretically double-book themselves if they open two tabs. Reservation system helps but doesn't fully prevent.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| 38     | **Service category/tag management**                        | M (1-2d)     | Full-stack     | Services have no category field. Hard to organize (manicure vs pedicure vs nail art). Admin must scroll through flat list.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| 39     | ~~**No customer-facing cancellation policy display**~~ ✅   | XS (30min)   | Frontend       | Added cancellation policy text block in BookingFlow Step 3 below the terms & conditions line.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| 40     | **No no-show tracking dashboard**                          | S (2-3h)     | Frontend       | Admin can't see which users have accumulated no-shows. `forgiven_no_shows` table exists but no UI.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| 41     | ~~**No timezone handling for international customers**~~ ✅ | XS (15min)   | Frontend       | **Intentionally not implemented.** Crussell is UK-only; Cloudflare blocks non-UK traffic. Added explanatory comments in BookingFlow.svelte and README.md so this stops being flagged.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| 42     | **Dark mode**                                              | M (1-2d)     | Frontend       | SvelteKit + Tailwind supports it easily. No dark mode toggle or `prefers-color-scheme` support.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| 43     | **PWA support**                                            | L (3-5d)     | Frontend       | No service worker, no manifest.json, no offline support. Customers can't "install" the booking app.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| 44     | **Automated database backups**                             | M (1d)       | Infrastructure | No backup strategy. PostgreSQL volume is persistent but no automated dumps, no point-in-time recovery. Can use `pg_dump` cron on the host — no external service needed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| 45     | **Loyalty stamp redemption + discount system**             | XL (5-7d)    | Full-stack     | **Plan written** (`.sisyphus/plans/45-loyalty-discount-system.md`). **Design:** (1) Auto-redeem: when stamps hit 10, create pending `loyalty_redemption`. (2) Discount applied at booking *completion* (not creation) — avoids cancellation edge cases. (3) 10% loyalty discount creates `discount` payment_method record, deducts 10 stamps. (4) Campaign system: `discount_campaigns` table for time-based sales (Easter 5% off, opening week 10% off first appointment). (5) Customer UI shows "next completed appointment gets 10% off" — NO exact prices. (6) Email notification TODO where SMTP will go. (7) `booking_discounts` table tracks all discounts applied. Priority: loyalty > campaign, one discount per booking. DB: 3 new tables + 2 new enums + 1 column alter. |
| ~~46~~ | ~~**Staff management**~~ 🗑️                               | —            | —              | Removed — single employee sole trader business, no multi-staff needed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| 47     | **Recurring bookings**                                     | L (3-5d)     | Full-stack     | Customers can't book the same slot weekly/monthly. Would need a `recurring_bookings` table + background job to materialize instances.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| ~~48~~ | ~~**Waitlist functionality**~~ 🗑️                         | —            | —              | Removed — not desired for this business.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| ~~49~~ | ~~**Image optimization for portfolio**~~ ✅                 | XS (30min)   | Frontend       | **Complete May 2026.** AVIF full-size (0.72 quality, 1500px max), WebP thumbnails (250x250), lazy loading all implemented. No srcset/picture needed — business decision.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| ~~51~~ | ~~**Test DB optimization**~~ ✅                             | M (1d)       | Backend        | **Complete May 2026.** TestMain per package (schema migration runs once per package, not per test). Per-test setup changed to TRUNCATE-only (~60% faster). 3 missing tables added to TruncateTables. discount_test.go moved to package bookings. Dead code removed. Flaky time-of-day tests fixed. Test output streamed in real-time via tee in local-dev-2.sh. **286/288 tests passing** (was 222/224).                                                                                                                                                                                                                                                                                                                                                                            |

---

# 🔴 External Gaps — Blocked on Third-Party Access

Require paid accounts, API approval, or external service credentials. **Do not attempt until access is granted.**

## Payment — Square

| # | Gap | Effort | Area | Status | Notes |
|---|-----|--------|------|--------|-------|
| E1 | **Payment integration (Square SDK)** | XL (3-5d) | Full-stack | 🔒 Blocked | BookingFlow Step 4 shows "Square payment integration will be added here". Need `github.com/square/square-go-sdk` + API credentials. |
| E2 | **No deposit payment flow** | M (1-2d) | Full-stack | 🔒 Depends on E1 | Users with `deposits_required > 0` can't pay deposits online. Blocked from new bookings until they pay in-person. |
| E3 | **Tip calculation UI** | S (1h) | Frontend | 🔒 Depends on E1 | `tip` exists in `payment_type` enum. No UI to add tips during payment or at the Today page. |
| E4 | **Gift card system** | L (3-5d) | Full-stack | 🔒 Depends on E1 | `giftcard` exists in `payment_method` enum. No gift card creation, redemption, or balance tracking. |

## Email/SMS — SMTP Provider (Resend, SendGrid, Twilio, etc.)

| # | Gap | Effort | Area | Status | Notes |
|---|-----|--------|------|--------|-------|
| E5 | **Email/SMS notification system** | XL (5-7d) | Backend | 🔒 Blocked | No SMTP integration. No scheduled jobs for booking reminders. `user_notification_preferences` table exists but unused. Need SMTP credentials or API key from provider. |
| E6 | **Automated deposit reduction notification** | S (1h) | Backend | 🔒 Depends on E5 | When `deposits_required` decreases, no notification is sent. User doesn't know they're closer to being unblocked. |
| E7 | ~~**Waitlist cancellation notifications**~~ | S (1h) | Backend | 🔒 Depends on E5 + ~~#48~~ | ~~When a slot opens up, waitlisted customers need to be notified.~~ Removed — waitlist not desired. |

## Cloud Storage — S3/R2 Production

| # | Gap | Effort | Area | Status | Notes |
|---|-----|--------|------|--------|-------|
| E8 | **S3/R2 production stubs** | M (1d) | Backend | 🔒 Blocked | `s3.go` (`!dev` build tag): Upload/Download/Delete all return "not implemented" errors. Prod builds cannot store images. Need AWS SDK v2 + R2/S3 credentials. Dev works fine with RustFS. |

## Social Auth — OAuth Apps (Google, Microsoft, Facebook)

| # | Gap | Effort | Area | Status | Notes |
|---|-----|--------|------|--------|-------|
| E9 | **Social auth (Google/Microsoft/Facebook)** | L (2-3d) | Backend | 🔒 Blocked | `handlers/auth/social.go` is 1 line. Need OAuth app registrations + client secrets for each provider. |

## Monitoring — Sentry / Error Tracking

| # | Gap | Effort | Area | Status | Notes |
|---|-----|--------|------|--------|-------|
| E10 | **Error tracking / monitoring** | M (1-2d) | Backend | 🔒 Blocked | No Sentry, no structured logging, no error aggregation. `log.Printf()` only. No alerting on 5xx errors. Needs Sentry DSN or equivalent. |

---

## Dependency Map

```
┌─────────────────────────────────────────────────────────┐
│                    EXTERNAL BLOCKERS                     │
│                                                         │
│  E1 Square API ──┬──→ E2 Deposit payments               │
│                  ├──→ E3 Tips                           │
│                  └──→ E4 Gift cards                     │
│                                                         │
│  E5 SMTP/API ────┬──→ E6 Deposit reduction notifications│
│                  └──→ E7 Waitlist notifications         │
│                                                         │
│  E8 S3/R2 ───────→ Portfolio images in production       │
│                                                         │
│  E9 OAuth Apps ──→ E9 Social auth                       │
│                                                         │
│  E10 Sentry ─────→ E10 Error tracking                   │
└─────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────┐
│                    LOCAL (UNBLOCKED)                     │
│                                                         │
│  #1 Delete account ──→ #7 GDPR export ──→ #14 SQL func │
│                                                         │
│  #3 Approval decline ✅──→ #13 Booking reschedule         │
│                                                         │
│  ~~#5 Admin notification panel~~ ✅ ──→ ~~#15 Preferences UI~~ ✅    │
│                              ──→ #48 Waitlist (removed)  │
│                                                         │
│  #2 Walk-in guest fix ──→ #9 Reservation transition     │
│                                                         │
│  #6 Reservation cron ──→ #42 Dark mode (no deps)        │
│                                                         │
│  #39 Cancellation policy ──→ ZERO deps, 30min fix       │
│  #28 Health check ──→ ZERO deps, 15min fix              │
│  #23 console.log cleanup ──→ ZERO deps, 15min fix       │
│  #24 Alert prototype cleanup ──→ ZERO deps, 30min fix   │
└─────────────────────────────────────────────────────────┘
```

---

## Suggested Execution Order

### Phase 1 — Zero-Dependency Quick Wins (Week 1)

*No external services. Each takes <30min except #1.*

1. **#23** Remove console.log debug statements (15min) ✅
2. **#24** Replace alert() prototypes with toast notifications (30min) ✅
3. **#28** Add health check endpoint (15min) ✅
4. **#39** Add cancellation policy display to BookingFlow (30min) ✅
5. **#41** Fix timezone display for international customers (15min) ✅
6. **#18** Add HSTS header (15min) ✅
7. **#19** Add Referrer-Policy header (15min) ✅
8. **#1** Fix `DELETE /api/user/account` (1-2h) — biggest win in this phase ✅
9. **#3** ApprovalModal decline/cancel (2-3h) ✅

### Phase 2 — Admin Productivity (Week 2)

9. **#2** Wire WalkInCreateModal guest booking (1-2h) ✅
10. **#3** ApprovalModal decline/cancel (2-3h) ✅
11. ~~**#5** Admin notification panel (1-2d)~~ ✅
12. **#4** CurrentAppointment Extend + Cancel actions (1d) — skip TakePayment (blocked on E1). **Edit** ✅ — now opens `EditBookingModal` for service management.
13. **#12** Booking cancellation from user account (2-3h)
14. **#40** No-show tracking dashboard (2-3h)
15. **#35** Walk-in slot blocking (1-2h) ✅

### Phase 3 — Compliance + Reliability (Week 3)

15. **#6** Reservation/anonymization background cron (2-3h)
16. **#7** GDPR data export endpoint (1d)
17. **#8** VAT/Tax export endpoints (1-2d)
18. **#14** Create `delete_guest_user()` SQL function (1h) ✅
19. **#27** Graceful shutdown (1h) ✅
20. ~~**#36**~~ ~~Idempotency keys for bookings~~ ✅ — implemented
21. **#30** XSS input sanitization (2-3h)
22. **#44** Automated database backups (1d)

### Phase 4 — User Experience (Week 4)

23. **#10** Password reset flow (2-3h)
24. **#11** Email verification flow (2-3h)
25. **#13** Booking rescheduling for users (1-2d)
26. **#20** Business settings management UI (1-2d)
27. **#16** One-off custom services (1-2d)
28. **#17** One-off exceptional hours (1d)
29. ~~**#35**~~ ~~Walk-in slot blocking~~ ✅ — resolved
30. **#38** Service category management (1-2d)

### Phase 5 — Growth + Polish (Week 5+)

31. **#21** Referral system UI (1-2d)
32. **#22** Analytics endpoints (1-2d)
33. ~~**#25**~~ ~~Customer relationship view~~ ✅ — implemented
34. **#26** CSV/Excel export (1d)
35. **#29** API documentation (1-2d)
36. ~~**#31**~~ Per-user rate limiting (1d)
37. **#32** CSRF protection (2-3h)
38. **#33** Begin button (Today page) (2-3h)
39. **#34** Auto lunch protection (1d)
40. **#37** Booking conflict detection (2-3h)
41. **#45** Loyalty stamp redemption (partial — UI + redeem endpoint, payment apply blocked on E1)
42. ~~**#46**~~ ~~Staff management~~ 🗑️ — single employee business
43. **#47** Recurring bookings (3-5d)
44. ~~**#48**~~ ~~Waitlist functionality~~ 🗑️ — not desired
45. ~~**#49**~~ ~~Image optimization~~ ✅ — complete
46. **#42** Dark mode (1-2d)
47. **#43** PWA support (3-5d)

### ⏳ Waiting on External Access

| Item | Blocked On | Unblocks |
|------|-----------|----------|
| **E1 Square payment** | Square API credentials | E2, E3, E4, deposit payments, loyalty redemption |
| **E5 Email/SMS** | SMTP provider (Resend/SendGrid/Twilio) | E6, E7, booking reminders, password reset emails |
| **E8 S3/R2 production** | Cloudflare R2 or AWS S3 credentials | Portfolio images in production builds |
| **E9 Social auth** | OAuth app registrations (Google/Microsoft/Facebook) | Social login flow |
| **E10 Sentry** | Sentry DSN or equivalent | Error tracking, 5xx alerting |
