app/REVIEW_FINDINGS.md

Codebase Audit — Findings

Severity tags: [CRITICAL] (exploitable / data-loss / breaks prod) · [HIGH] (real bug or security weakness) · [MEDIUM] (correctness/maintainability risk) · [LOW] (polish / nit). The ## Summary section is written last, at the top, once every file is reviewed.

---

Summary

Files reviewed: 277 / 277 (100%) — every tracked source/config file plus CLAUDE.md. 8 files came back fully clean.

Findings by severity: 2 CRITICAL · 44 HIGH · 115 MEDIUM · 201 LOW (≈362 total, including 9 project-level findings).

Project structure. Contrary to the "mess from many AIs" worry, the architecture is coherent and conventional: a single-package Fastify-5 + Prisma/MySQL backend (clean routes → services → Prisma layering, followed consistently) serving a React-18 + MUI-v7 + TanStack-Query SPA from the same process. The layering, response-envelope, permission, audit, and React-Query conventions are applied uniformly across all ~277 files — that consistency is the codebase's real strength. The "mess" is not architectural; it is (a) accumulated cleanup debt — a handful of 1,300–2,400-line God-files (warehouse.ts, InvoiceDetail.tsx, OfferDetail.tsx, attendance.service.ts, useAttendanceAdmin.ts), ~77 any escape hatches, several dead modules (STATUS_DOT_CLASS, ShortcutsHelp, useModalLock, dead deps) and working-tree cruft — and (b) missing guard-rails: no ESLint, an unpinned Prettier, and tests excluded from type-checking, which is precisely why a systemic Rules-of-Hooks bug and a wall of NaN-coercion gaps slipped in unnoticed. Recommendation: keep the current core (do not rewrite to Next.js or split repos) and spend the effort on linting + the targeted fixes below.

Dependencies. Healthy but drifting. npm audit reports 8 known vulns (6 moderate, 2 low) — quill XSS (mitigated by the DOMPurify-everywhere sanitization, verified), file-type DoS, react-router open-redirect, plus transitive ws/qs/brace-expansion; most are non-breaking npm audit fix. Three dead dependencies (react-datepicker, hi-base32, @types/mysql) should be removed. Several majors are behind (React 18→19, MUI 7→9, Prisma 6→7, react-router 6→7, TS 5.9→6) — none urgent for an internal tool, but Prisma 6→7 and React 18→19 are worth planning. No secrets are committed (good); .env.example is stale and there is no committed README.

Top 5 to fix first:

1. Systemic Rules-of-Hooks violation (2 CRITICAL + ~11 HIGH). ~13 detail/form pages declare useApiMutation after an early return <Forbidden/> (OrderDetail, ProjectDetail = CRITICAL; Settings, Trips, TripsAdmin, Users, Vehicles, AttendanceBalances, AuditLog, LeaveApproval, and 5 warehouse detail/form pages). React crashes ("rendered fewer hooks") when a user hits the page without the permission or permission state flips. Mechanical fix (move every hook above the guard); eslint-plugin-react-hooks would have caught all of them.
2. roles.ts privilege escalation (HIGH). A non-admin settings.roles holder can create a role — even one named admin — with arbitrary permission_ids, and rewrite the existing admin role's permissions via PUT (no admin gate on POST/PUT, only DELETE). Real escalation/lockout path. (Pair with trips.ts /users and vehicles.ts GET / missing-permission disclosure.)
3. Warehouse stock + money correctness (HIGH). confirmIssue/confirmInventorySession lock only the issue row (not item/batch), cancelReservation has no lock/transaction at all, and FIFO selection is a wide TOCTOU → lost updates, negative stock, double-issue. Compounded by the schema NaN-coercion gap: warehouse/trips/received-invoices/settings quantities, FKs, and security numbers (max_login_attempts, lockout_minutes) accept NaN/negatives — root cause is the missing shared coercion helper in schemas/common.ts.
4. VAT + concurrency data-integrity bugs (HIGH). received-invoices JSON-create computes VAT as net-from-gross, inconsistent with the other two paths (same invoice → different stored VAT); attendance.service.lockUserRow uses $executeRaw for a SELECT … FOR UPDATE (the punch lock may not hold); exchange-rates fetch has no timeout (a hung ČNB endpoint blocks the event loop); numbering/users/offers have first-of-year / uniqueness TOCTOU races (500 instead of 409/retry).
5. Missing engineering guard-rails + the nas-offers-manager silent catches (HIGH). Add ESLint + typescript-eslint + eslint-plugin-react-hooks, a committed Prettier as a real devDep, and type-check the tests (tsconfig.test.json) — this single investment would have caught #1 and a large share of the MEDIUM findings automatically. Separately, nas-offers-manager.ts has five fully-silent catch {} blocks (a failed offer-PDF save/delete is invisible), violating the project's own never-swallow rule.

Note on test confidence: the suite is server-side only (no component tests) and has real gaps on the happy paths — no successful-login / refresh-rotation test, no happy-path verifyAccessToken test, and the exchange-rates module cache is never reset between tests (order-dependent). Warehouse FIFO is asserted only by total-quantity conservation, not oldest-batch-first. Green tests therefore give less assurance on auth and stock valuation than the count (195) suggests.

---

PROJECT-LEVEL

System core (what this app actually is)

A single-package full-stack monolith, and — contrary to the "mess from many AIs" worry — the bones are coherent and conventional:

• Backend: Fastify 5 JSON API. Entry src/server.ts registers ~29 route plugins under /api/admin/*. Clean 3-layer split: routes (HTTP, Zod validation, auth guards, success/error helpers) → services (plain exported async functions, own Prisma) → Prisma/MySQL (52 models, snake_case). Cross-cutting infra: JWT(HS256)+TOTP auth with hashed refresh-token rotation, custom security headers + prod CSP, node-cron (invoice alerts), Puppeteer (PDF), nodemailer (email), Anthropic SDK (Odin AI).
• Frontend: React 18 SPA in src/admin/, built by Vite, served by the same Fastify process (Vite middleware in dev, @fastify/static in prod). MUI v7 + Emotion, TanStack Query for all data, React Router 6. Component kit in ui/, pages lazy-loaded.
• Build topology: one package.json, three tsconfigs via a solution file — tsconfig.server.json (CJS → dist/) and tsconfig.app.json (ESM, noEmit, Vite owns emit). Tests (Vitest) hit a real MySQL test DB.

Verdict on structure: This is a textbook layered monolith and the layering is followed consistently across the whole tree. The separation of concerns is good. The "mess" is not architectural — it's (a) a handful of God-files, (b) missing tooling/hygiene scaffolding, (c) accumulated dead weight (deps + working-tree cruft), and (d) ~77 any escape hatches. None of that requires re-architecting; it requires a cleanup pass. Recommendation: keep the current core; do not migrate to Next.js/separate repos — the unified Fastify-serves-SPA model is appropriate for an internal tool and a rewrite would cost far more than it returns.

[HIGH] No linter anywhere; formatter is unpinned and undeclared

• There is no ESLint config (eslint.config.*/.eslintrc absent) and no ESLint dependency. A 77k-LOC TS/React codebase with no static lint is the single biggest hygiene gap — it's why 77 anys, unused vars, and hook-dep mistakes go uncaught. The app tsconfig even sets noUnusedLocals: false / noUnusedParameters: false, so the compiler won't flag dead code either.
• .claude/hooks/format-on-save.js runs npx prettier --write, but prettier is not in devDependencies and there is no .prettierrc. Formatting is therefore whatever an ad-hoc npx-fetched Prettier defaults to — not reproducible, not enforced in CI.
• Recommend: add eslint + typescript-eslint + eslint-plugin-react-hooks (the hooks plugin alone would catch a class of frontend bugs), add prettier as a real devDep with a committed config, and wire both into an npm script / pre-commit.

[HIGH] Test sources are never type-checked

tsconfig.server.json excludes src/__tests__, and tsconfig.app.json does not include it — so no project type-checks the test files. npx tsc -b (the documented gate) silently skips 19 test files. Type errors in tests only surface at vitest run. Add a tsconfig.test.json (or include tests in a checked project) so the gate actually covers them.

[MEDIUM] God-files — a few modules carry far too much

Largest files by LOC: routes/admin/warehouse.ts 2399, pages/InvoiceDetail.tsx 2243, pages/OfferDetail.tsx 2059, services/attendance.service.ts 1700, pages/CompanySettings.tsx 1503, hooks/useAttendanceAdmin.ts 1402, pages/Settings.tsx 1354, pages/Attendance.tsx 1266. These are hard to hold in context, hard to review, and the most likely homes for latent bugs. routes/admin/warehouse.ts in particular should be split per sub-entity (items/receipts/issues/reservations/inventory) the way the pages already are. (Per-file findings below will flag specific seams.)

[MEDIUM] ~77 any escape hatches erode the strict-mode guarantee

grep finds 77 as any / : any in src. CLAUDE.md explicitly warns that typing authData as any hides the roleName vs role bug — yet route files (plan.ts, projects.ts, quotations.ts, sessions.ts, trips.ts) and services/audit.ts use any. Each is a hole where the type system stops helping. Most are (request.params as any).id / (request.body as any) which a small set of typed helpers would remove. Flagged per-file where they hide real risk.

[MEDIUM] Dependency drift + 8 known vulnerabilities (npm audit)

npm audit: 8 vulns (6 moderate, 2 low). Notable: quill 2.0.3 XSS via HTML-export (pulled by react-quill-new; partly mitigated here because rich-text is DOMPurify-sanitized on both render and PDF paths), file-type ASF infinite-loop DoS, react-router open-redirect via protocol-relative // path, plus ws/qs/brace-expansion transitive DoS/disclosure. Most are npm audit fix (non-breaking); quill and file-type need a major bump. Major versions behind (review before jumping — all breaking): React 18→19, MUI 7→9, @mui/x-date-pickers 8→9, Prisma 6→7, react-router 6→7, TypeScript 5.9→6, file-type 16→22 (ESM-only), @fastify/multipart 9→10. None are urgent for an internal app, but Prisma 6→7 and React 18→19 are the strategically important ones to plan.

[MEDIUM] Dead dependencies (classic multi-AI residue)

Verified zero imports in src: react-datepicker (replaced by @mui/x-date-pickers — remove), hi-base32 (TOTP now via otpauth — remove), @types/mysql (no mysql package used; Prisma is the driver — remove). Removing these shrinks the install and the audit surface. (qrcode, leaflet, file-type, dompurify, nodemailer, @dnd-kit are all genuinely used.)

[MEDIUM] No committed README; .env.example is stale

• No README is tracked (README.md exists only as an untracked working-tree file). A production app should have a committed README covering setup/run/deploy. (CLAUDE.md is excellent and partly compensates, but it's agent-facing, not a project README.)
• .env.example is missing many real env vars that config/env.ts reads: ANTHROPIC_API_KEY, NAS_FINANCIALS_PATH, NAS_OFFERS_PATH, SMTP_FROM_NAME, INVOICE_ALERT_EMAIL, RATE_LIMIT_*, TRUST_PROXY, TOTP_ALGORITHM/DIGITS/PERIOD, LOGIN_TOKEN_EXPIRY_MINUTES. A fresh checkout can't discover these without reading source.

[LOW] .gitignore lets build/junk leak into the working tree

.gitignore covers node_modules/dist/dist-client/.env* but not *.tsbuildinfo, *.bak, or stray artifacts. The working tree currently holds untracked cruft: tsconfig.app.tsbuildinfo, tsconfig.server.tsbuildinfo, prisma/schema.prisma.bak, simon/plan_boha.pdf, .playwright-mcp/, frontend_Design_flaws.md, plan-*.png screenshots. None are committed (good), but add *.tsbuildinfo and *.bak to .gitignore and clear the loose files so the tree reads clean.

[LOW] Per-request auth does several uncached DB round-trips

verifyAccessToken → loadAuthData runs on every authenticated request and issues: user+roles+permissions join, a company_settings lookup for require_2fa, and — for admins — a full permissions table scan (findMany) every call. Correct, but it's 2–3 queries per request with zero caching. Fine at current scale; a short-TTL in-memory cache of permissions-by-role would cut DB load materially if traffic grows. (Noting once here rather than per-route.)

Positives worth preserving

Timing-safe login (dummy-bcrypt on every failure path), refresh-token rotation with replaced_by_hash reuse-detection and FOR UPDATE locking, hashed (not plaintext) refresh tokens, strict secret validation at boot (64-hex JWT/TOTP keys, port range), health check before rate-limit, consistent {success,error} envelope, DOMPurify on both render and PDF paths, prod-only HSTS+CSP, and a genuinely thorough CLAUDE.md. The conventions doc + the 2026-06-06 audit show the team already fights entropy deliberately.

---

src/server.ts

• [LOW] Function('return import("vite")')() indirect-eval hack (line 160) to load ESM Vite from the CJS bundle — intentional, brittle. Otherwise clean: plugin order, health check before rate-limit, graceful shutdown.

src/config/env.ts

• [LOW] Global Date.prototype.toJSON override (lines 14-22) — documented PHP-compat gotcha; app-wide. Strong boot-time secret/port validation. Clean.

src/config/database.ts

• Clean — single PrismaClient singleton.

src/middleware/security.ts

• [LOW] CSP/HSTS prod-only (line 18); style-src 'unsafe-inline' required by Emotion; no report-uri. Clean.

src/middleware/auth.ts

• Clean — correct reply.sent short-circuit, admin bypass via roleName.

src/utils/response.ts

• Clean — envelope helpers + parseId (NaN/≤0 → 400).

src/services/auth.ts

• [MEDIUM] Refresh-token rotation rejects replaced/expired tokens but does NOT revoke the token family on detected reuse (lines 273-280) — no breach containment.
• [LOW] loadAuthData runs on every request (2-3 queries; admin full permissions.findMany scan). Strong otherwise (timing-safe, hashed tokens, FOR UPDATE, lockout).

src/services/ai.service.ts

• [LOW] extractInvoice JSON.parse of model output unguarded (line 351) — low risk with json_schema. Budget/cost ledger correct.

src/routes/admin/ai.ts

• [LOW] extract-invoices swallows per-file failure / budget-exhausted-mid-batch into partial success, no truncation signal (lines 130-131). Otherwise clean (guard, parseId/parseBody, per-user ownership, audit).

src/routes/admin/attendance.ts

• [MEDIUM] Many handlers use raw reply.send envelope instead of success()/paginated() (lines 32,108,118,128,142,165-239).
• [LOW] action=project_logs (line 189) — no ownership check (location path does enforce it); Number(query.year) NaN fallbacks.

src/routes/admin/audit-log.ts

• [MEDIUM] Number(query.user_id) (line 33) → NaN → Prisma 500 instead of 400.
• [LOW] date_to+"T23:59:59" (line 40) — malformed date → 500.

src/routes/admin/auth.ts

• Clean — TOTP replay protection, single-use login token, httpOnly/secure/sameSite=strict cookie, rate limits, audit.

src/routes/admin/bank-accounts.ts

• Clean — settings.banking guard, parseId/parseBody, existence checks, audit.

src/routes/admin/company-settings.ts

• [LOW] Extra findFirst for has_logo (302-307, deliberate); request-time require(package.json); PUT Number() without NaN re-guard (481). Clean (magic-byte MIME sniff, race-safe create).

src/routes/admin/customers.ts

• [MEDIUM] GET / raw reply.send envelope (100-104) instead of paginated(). Otherwise clean (guards, FK-check before delete, allow-listed sort, parameterized search).

src/routes/admin/dashboard.ts

• [MEDIUM] N+1: today_plan per-cell plan_categories.findUnique (55-67); bounded but should be one findMany.
• [LOW] created_at ?? "" dead fallback (314). Otherwise clean (gated, Promise.all, parameterized $queryRaw).

src/routes/admin/leave-requests.ts

• [MEDIUM] GET / raw reply.send envelope (57-61).
• [LOW] Approval path drops reviewer_note (302-309) though rejection saves it. Otherwise clean (transactional approval, owner+pending cancel, audit).

src/routes/admin/profile.ts

• Clean — current-password verify, email-uniqueness in tx (409), tokens invalidated on pwd change, self-scoped, audit.

src/routes/admin/invoices.ts

• [LOW] GET / raw reply.send envelope (62-66); module-scoped markOverdueInvoices throttle can double-run under concurrency (30-39, self-correcting). Otherwise clean.

src/routes/admin/invoices-pdf.ts

• [LOW] JSON.parse(settings.custom_fields) (451) has no try/catch → malformed JSON makes whole PDF 500; save=1 raw envelope (1073); loose typing. Note: notes IS DOMPurify+cleanQuillHtml sanitized (521).

src/routes/admin/offers-pdf.ts

• [LOW] save=1 raw envelope (761); local cleanQuillHtml strips only javascript: (not data:/vbscript:) — defense-in-depth only (DOMPurify first, 357). Clean.

src/routes/admin/orders.ts

• [MEDIUM] From-quotation multipart parses fields.quotationId with raw parseInt (123) not schema/parseId.
• [LOW] Raw request.body casts (203,313); unbounded multipart field/file count (only fileSize limited). Otherwise solid.

src/routes/admin/orders-pdf.ts

• [HIGH] POST renders an official "Order Confirmation" PDF entirely from client-supplied body.items (304-312) — orders.view holder can fabricate descriptions/prices not reflecting stored data (downloadable, not persisted → limited impact; trust/authz concern).
• [LOW] Deprecated .passthrough() (30); loose untyped body.lang/applyVat; (order as Record).payment_method cast (387). notes sanitized (409).

src/routes/admin/quotations.ts

• [MEDIUM] GET /:id second quotations.findUnique for lock info right after getOffer(id) (123-129) — redundant query per detail view.
• [LOW] (result as any).status cast (286); empty catch {} on NAS PDF delete commented "Non-fatal" but does NOT log (321-323). Lock/heartbeat/unlock scoped to locked_by=userId (correct).

src/routes/admin/received-invoices.ts

• [HIGH] JSON single-create computes vat_amount=(amount*vat_rate)/100 (394-397) — treats GROSS as net, violating gross-VAT convention and INCONSISTENT with multipart (297) + update (467) paths using vatFromGross. Same invoice → different VAT by entry path.
• [LOW] GET / raw envelope (89-93); stats sumCzk sequential + throws on unknown currency → 500 (135); multipart create loops per-file with no transaction (partial-success on failure).

src/routes/admin/scope-templates.ts

• [MEDIUM] No logAudit on ANY mutation (create/update/delete of scope + item templates) — audit-convention violation.
• [MEDIUM] DELETE ?action=item&id=X uses Number(query.id) no NaN/existence guard (134-139) → 500; no row-exists/is_deleted check.
• [LOW] ?action= dispatch mixes two entities in one handler; Number(body.id)/Number(query.id) instead of validated ids.

src/routes/admin/plan.ts

• [LOW] (result.data as any).id/(result.oldData as any) audit casts (256,310,334,361,392,416). Otherwise clean — guards on every route, parseId/parseBody, audit on every mutation, isAdminLike reads roleName, 92-day range cap.

src/routes/admin/project-files.ts

• [LOW] Folder-create (120) and move (236) read raw request.body bypassing parseBody (manually String-coerced). Path traversal delegated to resolveProjectPath (sound). Clean.

src/routes/admin/projects.ts

• [MEDIUM] GET / raw envelope (44-48).
• [LOW] DELETE reads unvalidated body for delete_files (182-183); (result as any).status casts; POST /:id/notes does NOT logAudit though note-delete does (126-148) — inconsistent audit.

src/routes/admin/roles.ts

• [HIGH] POST / no uniqueness guard on roles.name and no admin-only gate — a non-admin settings.roles holder can create a role (even named admin) and attach ANY permission_ids → privilege escalation (59-98). PUT /:id can rewrite the admin role's permissions (no name==="admin" guard like DELETE) → escalation/lockout (102-138).
• [MEDIUM] Role insert + permission assignment in separate transactions (67-73 vs 76-86) — partial failure leaves orphan role.

src/routes/admin/sessions.ts

• Clean — ownership-scoped queries, audit on terminate/terminate-all, current-session via hashToken. No IDOR.

src/routes/admin/totp.ts

• [HIGH] /enable verifies the new secret with hardcoded SHA1/6/30 (87-94) not config.totp.* — config divergence → enrolled secrets verify under different params than login → lockout.
• [MEDIUM] /backup-verify bcrypt-compares every code, no early-exit on match (307-312) — N bcrypt ops/attempt.
• [LOW] /enable change-flow (2FA on) needs only a live code, not password (65-76); redundant dynamic re-imports shadow config (363-370).

src/routes/admin/trips.ts

• [MEDIUM] GET /users (83) guarded only by requireAuth — any authenticated user enumerates all active users. Information disclosure.
• [MEDIUM] GET / raw envelope (73-77).
• [LOW] In-handler permission checks run after parseBody; POST create unconditionally sets vehicle.actual_km=end_km (244-247) — can regress odometer (PUT/DELETE recompute via MAX). PUT/DELETE ownership checks correct.

src/routes/admin/users.ts

• [LOW] Non-admin escalation guard strips role_id/is_active (109-114, good); bounded as Parameters<...> cast (121); forced logout on pwd change not separately audited. Clean (parseId/parseBody/guard/audit, paginated used).

src/routes/admin/vehicles.ts

• [MEDIUM] GET / guarded only by requireAuth (15) — any authenticated user lists all vehicles + stats; mutations need vehicles.manage. Read should require a view permission. Otherwise clean (single groupBy, delete blocks linked trips).

src/routes/admin/warehouse.ts

• [HIGH] confirmIssue locks only the sklad_issues row, not item/batch (service:523) — two different draft issues selecting the same FIFO batch confirm concurrently, both read-modify-write batch.quantity -> lost update, negative stock, double-issue. Same gap in confirmInventorySession.
• [HIGH] FIFO batch selection at issue create/update (1496-1499,1622-1625) runs with no lock, persists chosen batch on draft; availability re-checked only at confirm -> wide TOCTOU/oversell.
• [HIGH] Reports stock-status/project-consumption/movement-log/below-minimum have NO pagination + per-item N+1 (3 sequential aggregates/item; 629-646,2174-2306).
• [MEDIUM] PUT receipts/issues/inventory-sessions do deleteMany+createMany on lines with NO $transaction (1150-1164,1660-1673,2090-2098) -> failure leaves draft with no lines.
• [MEDIUM] Attachment save: NAS write then DB insert, no compensating delete (orphan on DB failure); confirm does not verify batch.item_id===line.item_id (wrong item decremented); received_by overwritten at confirm (service:350).
• [MEDIUM] 2399-line file bundles 8 sub-entities + inline mid-file multipart register (963) — split per sub-entity.
• [LOW] Unvalidated query.status / Number(query.x) filters; pervasive Record-cast querystrings. Every handler guarded, tiers consistent, attachment DELETE ownership-checked — no missing-guard/IDOR.

src/services/attendance.service.ts

• [HIGH] lockUserRow uses tx.$executeRaw for a bare SELECT ... FOR UPDATE (85) — $executeRaw is for write statements; the punch/switch concurrency lock may not reliably hold. Should be tx.$queryRaw.
• [HIGH] getBalances N+1: one leave_balances.findFirst per user in a loop (491), unbounded.
• [MEDIUM] createLeave books a Dec->Jan range entirely against the start year (getFullYear, 1261); getStatus runs 5 independent queries serially.
• [LOW] deleteAttendance (1694) has no ownership param (unlike updateAttendance); hardcoded 160 vacation default x3; ~1700-line file should be split.

src/services/audit.ts

• [LOW] safeJsonReplacer duck-types Prisma Decimal via method presence (14-19) — instanceof would be precise. Failure caught+logged. Clean.

src/services/exchange-rates.ts

• [HIGH] fetch(url) (33) has NO timeout/AbortController — a hung CNB endpoint blocks every awaiting caller indefinitely.
• [MEDIUM] Global single rateCacheTime (14,22-24) — a hit on one key refreshes TTL for ALL keys; date-specific entries can outlive TTL; stale-fallback only checks today.
• [LOW] No validation data.rates is an array before iterating (39).

src/services/invoice-alerts.ts

• [MEDIUM] Created-invoice alert amount uses only subtotal (net, 92-95) while received invoices show gross — inconsistent; per-invoice invoice_alert_log.findUnique N+1 (81,142).
• [LOW] Dead/identical ternary branches (232-239); sequential unguarded create loop can re-fire alerts; escapeHtml omits the apostrophe char.

src/services/invoices.service.ts

• [MEDIUM] Three divergent money/VAT implementations: computeInvoiceTotals (47-74), invoiceTotalWithVat (164-196), stats VAT loop (264-270, no per-line rounding) — inconsistent totals risk.
• [MEDIUM] getInvoiceStats serializes many toCzk awaits (247-295) — should Promise.all; createInvoice/updateInvoice take body: Record<string,any> with unchecked as InvoiceItemInput[] casts.
• [LOW] deleteInvoice derives year from invoice_number.split("/")[1] (497) -> wrong sequence released for non-standard numbers; getInvoice returns null not {error,status}; paid_date settable on non-paid invoice (463).

src/services/leave-notification.ts

• [LOW] formatDate try/catch ineffective — new Date(invalid) returns Invalid Date, never throws (13-18). Header injection mitigated via sanitizeHeaderValue; send failure logged. Clean.

src/services/mailer.ts

• [MEDIUM] Transport hardcoded to local sendmail /usr/sbin/sendmail (5-9) — Linux-only, no SMTP fallback; on hosts without the binary every send silently fails (console.error only).
• [LOW] to not validated/sanitized for CRLF (11) — nodemailer guards most.

src/services/system-settings.ts

• [LOW] JSON.parse of vat-rates/currencies (56,61) no shape validation; process-local cache won't propagate cross-instance within 60s TTL. Two empty catches are commented expected-condition guards (OK). Clean.

src/services/nas-file-manager.ts

• [MEDIUM] TOCTOU between resolveProjectPath validation (701-713) and the later fs op on the returned path — a symlink swapped into a path component could bypass the guard (low risk on a trusted share); ".." matched as literal substring (679, contained by prefix check).
• [LOW] createProjectFolder sync/non-atomic (idempotent); MIME gate passes type-less files (SVG served as attachment w/ nosniff -> mitigated); collision suffix loop can yield name_1_2.

src/services/nas-financials-manager.ts

• [MEDIUM] Fully synchronous fs over a network share on the request path (39-73,81+) — slow/hung NAS blocks the event loop.
• [LOW] isConfigured() does mkdirSync as a predicate side effect (24); saveIssuedInvoicePdf skips isConfigured() (asymmetry). resolveSafePath guard correct.

src/services/nas-offers-manager.ts

• [HIGH] Five fully-silent empty-catch blocks, no log/comment (24,46,59,76,111) — violates never-swallow rule; sibling financials manager logs all of them -> failed offer-PDF save/delete is invisible.
• [LOW] deleteOfferPdf readdir/rmdir swallowed (covered above); isConfigured() mkdir side effect. resolveSafePath correct.

src/services/numbering.service.ts

• [MEDIUM] getNextSequence first-of-year INSERT race (61-75) -> @@unique([type,year]) P2002 as 500 instead of retry.
• [MEDIUM] releaseSequence (116-158) SELECT-then-UPDATE with no transaction/lock/tx param — concurrent delete+create can lose a decrement or decrement an in-use number (gap/dup).
• [LOW] releaseSequence reconstructs highest number from current settings (144-149); changed pattern -> no-op -> gap.

src/services/offers.service.ts

• [MEDIUM] createOffer TOCTOU: isOfferNumberTaken runs BEFORE the tx (162-167), create inside does not re-check -> concurrent dup numbers (orders.service fixed this).
• [LOW] deleteOffer never calls deleteOfferPdf -> orphaned PDF on NAS; pervasive any in enrich/list money math.

src/services/orders.service.ts

• [LOW] enrichOrder/getOrder treat projects as array projects?.[0] (60,151) — confirm cardinality; status->project-status sync duplicated verbatim in both update branches (525-538 & 572-585); deleteOrder FK guard runs outside the tx (599,617-634) -> narrow re-intro window. Tx boundaries otherwise correct.

src/services/plan.service.ts

• [MEDIUM] N+1 per mutation: resolvePlanLabels(2q)+resolveCategoryLabel(1q) after each write for the audit description (483-489); bulkCreateEntries multiplies it.
• [LOW] createEntry cap check outside any tx (464) — concurrent creates can exceed cap (intentional per comment). UTC date math deliberate.

src/services/planCategory.service.ts

• [LOW] slugifyCategory strips a literal combining-marks range (file-byte fragile); uniqueKey unbounded collision loop + race; sort_order=max+1 outside tx (dup possible). Soft-delete-aware checks correct.

src/services/projects.service.ts

• [LOW] updateProject renames NAS folder after DB commit outside any tx (DB/NAS divergence, failure unlogged at call site, 143); getProject does a synchronous full-base readdirSync on every GET (95); deleteProject removes folder BEFORE the DB delete (218) — inconsistent with orders.service DB-first ordering; Record<string,any> typing.

src/services/users.service.ts

• [MEDIUM] createUser username/email uniqueness via separate findFirst BEFORE a non-transactional create (116-142) — TOCTOU; duplicate -> unhandled 500 not 409 (updateUser already fixed this in a tx).
• [LOW] createUser no in-service min password length (updateUser requires >=8); where: any. Last-admin + self-delete guards correct.

src/services/warehouse.service.ts

• [HIGH] cancelReservation (959-988) has NO row lock and NO transaction — a concurrent confirmIssue fulfilling the same reservation interleaves -> lost fulfillment, double-counted stock. Every other warehouse op locks the parent row; this one was missed.
• [MEDIUM] selectFifoBatches orders only by received_at no id tie-break (170) + second-truncated precision -> nondeterministic FIFO; getBelowMinimumItems N+1 (232-261).
• [LOW] validateIssueReservationRules N+1; confirmInventorySession negative-diff decrements item_locations independent of consumed batches (drift); surplus enters at unit_price:0 (valuation); dead itemQty/linePrice locals. Lock/FIFO/storno guards otherwise correct.

src/schemas/common.ts

• [HIGH] Contains only parseBody — NO shared coercion helpers despite the convention; the z.union number/string transform idiom is re-implemented ~150x across schemas with no shared home. Root cause of the NaN findings below.
• [LOW] Deprecated ZodSchema import (1); Zod 4 prefers z.ZodType.

src/schemas/ai.schema.ts

• [LOW] Message objects plain z.object (not strict); AiBudgetSchema.budget_usd no upper bound (39, but Number.isFinite-guarded).

src/schemas/attendance.schema.ts

• [HIGH] Pervasive unguarded Number(v) transform with NO NaN check on user_id, year, vacation/sick totals, project_id, leave_hours, and all lat/lng/accuracy fields (13-145) — NaN flows to service/Prisma; project_id NaN -> bogus FK.
• [MEDIUM] Time fields (arrival/departure/break) unbounded z.string() with no HH:MM regex (45-48 etc.).
• [LOW] Plain z.object not strict; minutes not capped at 59.

src/schemas/auth.schema.ts

• [MEDIUM] username/password and TOTP password fields have no .max() (4-5) — unbounded string to bcrypt (file caps backup codes for this exact DoS reason but not password).
• [LOW] totp_code .length(6) but not digits-only; plain objects.

src/schemas/bank-accounts.schema.ts

• [MEDIUM] iban/bic/account_number/currency/names all unbounded nullish strings (4-9) — no length caps, no IBAN/BIC/ISO format checks.
• [LOW] position unguarded number-from-form (NaN); plain objects.

src/schemas/customers.schema.ts

• [MEDIUM] custom_fields: z.array(z.any()) (11,23) — fully over-permissive, arbitrary nested payload persisted as-is.
• [LOW] All address/id strings unbounded, no format checks; plain objects.

src/schemas/invoices.schema.ts

• [LOW] quantity/unit_price throw on NaN (good) but vat_rate/position/order_id/customer_id use the UNGUARDED idiom; status/currency/language free strings (no enum); unbounded text; plain objects.

src/schemas/leave-requests.schema.ts

• [LOW] date_from/date_to min(1) no YYYY-MM-DD regex, no date_to>=date_from cross-check; unbounded notes; plain objects.

src/schemas/offers.schema.ts

• [LOW] Number coercions correctly refine(!isNaN) but re-implement the idiom ~7x; currency/language free strings; unbounded text; plain objects.

src/schemas/orders.schema.ts

• [LOW] Same as offers — refined but duplicated idiom; free currency/language; unbounded text; plain objects.

src/schemas/plan.schema.ts

• [LOW] intFromForm (7-10) is a proper guarded helper but defined locally (belongs in common.ts); project_id coercions (21-102) use the UNGUARDED idiom not intFromForm -> NaN FK; plain objects.

src/schemas/planCategory.schema.ts

• Clean

src/schemas/profile.schema.ts

• [MEDIUM] new_password .min(8) no .max() (8); current_password unbounded — unbounded to bcrypt.
• [LOW] first_name/last_name no min/max; plain objects.

src/schemas/projects.schema.ts

• [LOW] Create FK fields refine-guard NaN, but Update + quotation_id/order_id use the UNGUARDED idiom (29-44) -> NaN FK on update; status free string (no enum); date strings no regex; plain objects.

src/schemas/received-invoices.schema.ts

• [HIGH] month/year coerce via Number(v) with NO NaN guard AND no range bounds (5-6,53-60) — month not 1-12, year unbounded; flows into the ledger + date logic.
• [MEDIUM] amount/vat_rate/vat_amount unguarded idiom (NaN); vat_rate no range bound (negative/>100 accepted) — load-bearing for gross VAT back-calc.
• [LOW] Unbounded text; plain objects.

src/schemas/roles.schema.ts

• [LOW] permission_ids: z.array(z.number()) not .int()/positive, no .max() length; name no slug/format; unbounded text; plain objects.

src/schemas/scope-templates.schema.ts

• [LOW] position/id/default_price unguarded number-from-form (NaN); name/title nullish/optional with no .min(1) (nameless template passes); unbounded text; plain objects.

src/schemas/settings.schema.ts

• [MEDIUM] Every numeric setting — incl. security-relevant max_login_attempts, lockout_minutes, max_requests_per_minute (15-62) — uses the unguarded idiom with NO NaN guard and NO range bounds; NaN/0/negative can disable lockout/rate-limit.
• [MEDIUM] custom_fields/supplier_field_order: z.array(z.any()); available_vat_rates no int/range; available_currencies no enum.
• [LOW] Email-ish fields no .email(); plain objects.

src/schemas/trips.schema.ts

• [HIGH] start_km/end_km/vehicle_id/user_id use the unguarded idiom — NO NaN check; confirmed routes/admin/trips.ts:226 end_km<start_km guard is bypassed when either is NaN (NaN compare = false) and Number() then writes NaN to Prisma. Real data-integrity bug.
• [LOW] route_from/route_to unbounded; trip_date no regex; plain objects.

src/schemas/users.schema.ts

• [MEDIUM] password .min(8) no .max() (6,22-25) — unbounded to bcrypt.
• [LOW] role_id unguarded NaN; username/names no .max(); plain objects.

src/schemas/vehicles.schema.ts

• [LOW] initial_km/actual_km unguarded NaN + no .min(0) (negative odometer); spz/name no .max()/plate regex; plain objects.

src/schemas/warehouse.schema.ts

• [HIGH] All movement quantities/prices (ReceiptItem/IssueItem/InventoryItem/Reservation, 124-219) use the unguarded idiom — NO NaN guard, NO .min/positivity; confirmed these feed stock math in warehouse.service -> NaN/negative corrupt inventory totals.
• [MEDIUM] All FK coercions (item_id/category_id/supplier_id/project_id/location_id/batch_id/reservation_id) unguarded -> NaN FK to Prisma lookups.
• [LOW] Supplier email/phone no format check; date strings no regex; unbounded text; plain objects; idiom duplicated dozens of times.

src/utils/czech-holidays.ts

• [LOW] Easter calc parses YYYY-MM-DD as UTC midnight then reads with local getters (50-57) — correct only because Prague is east of UTC; a negative-offset TZ would be a day early (safe today, fragile). Minor formatting duplication. holidayCache bounded by year.

src/utils/date.ts

• Clean

src/utils/encryption.ts

• [MEDIUM] Format detection via split(":").length===3 (27-28) — brittle (a malformed TS value falls through to base64 branch). Crypto sound: random IV per encrypt (no reuse), GCM tag verified, raw 32-byte key. A version/prefix tag would be more robust.

src/utils/html-to-pdf.ts

• [MEDIUM] process.env.CHROMIUM_PATH || "/usr/bin/chromium-browser" || "/usr/bin/chromium" (21-24) — third path is dead (second operand always truthy); if only chromium exists, launch fails. Browser lifecycle/finally sound (no leak). Injection safety handled upstream.

src/utils/pagination.ts

• [LOW] sort/search passed through unvalidated (19,22) — trust-boundary note for callers (orderBy field needs an allowlist); page/limit clamping correct.

src/utils/planAuditDescription.ts

• Clean

src/utils/totp.ts

• [LOW] console.error logs raw error on decrypt/verify failure (27) — no secret leak; swallow-to-{valid:false} intentional. Correct RFC-6238 (window:1, params from config); replay protection in auth.ts.

src/types/fastify.d.ts

• Clean

src/types/index.ts

• [LOW] JwtPayload.role vs AuthData.roleName (51,60) — the documented footgun that invites authData.role==="admin"; no bug here but a hazard.

prisma/seed.ts

• [MEDIUM] main() unconditionally deleteManys ALL role_permissions + permissions (321-322) before re-inserting — prod-destructive if ever misused (custom roles lose all permissions; stale-reconciliation at 351-368 is dead after the wipe). Dev-only by policy.
• [LOW] Seeds an admin/admin user hashing the literal "admin" (389) — dev convenience, risk if run on a reachable env.

scripts/migrate-received-invoices-to-nas.ts

• [LOW] Treats saveReceivedInvoice as sync (41) — verify; sets file_data: null after a claimed-success save with no read-back verification (56) — a 0-byte/corrupt write would lose the only DB copy (one-shot migration).

scripts/rotate-totp-key.ts

• [HIGH] Hand-rolled decrypt (6-14) only handles the TS iv:enc:tag format; PHP-legacy base64 secrets (no colon) -> Buffer.from(undefined,'hex') throws inside $transaction with no per-user try/catch (58-65) -> the FIRST legacy secret aborts/rolls back the ENTIRE batch. Should reuse src/utils/encryption.ts dual-format decrypt.
• [LOW] Dry-run shows [FAIL] rows for legacy secrets the real run cannot process — operator must not ignore them.

prisma/schema.prisma

• [HIGH] Entire sklad_* (warehouse) module declares relations with NO explicit onDelete (780-958) — header->line deletes and master-data deletes get engine-default behavior, inconsistent with the explicit cascade/setNull/restrict used everywhere else; define explicit onDelete (Cascade line->header, Restrict line->master-data).
• [MEDIUM] Warehouse document numbers receipt_number/issue_number/session_number (825,877,935) are nullable and NOT unique — unlike every other document-number column (invoice/order/quotation are @unique); two receipts can share a number.
• [MEDIUM] invoices.order_id/customer_id, orders.quotation_id/customer_id, quotations.customer_id, project FKs have no explicit onDelete (default Restrict — likely intended but implicit). Several *_id are bare Int with no relation/FK -> orphan risk (received_invoices.uploaded_by, quotations.locked_by can point at deleted users).
• [MEDIUM] sklad_issues.project_id/issued_by, sklad_receipts.supplier_id/received_by, bank_accounts declare no @@index (MySQL auto-indexes the FK constraint, but non-FK hot filters are uncovered and the schema is inconsistent vs the rest).
• [LOW] Most modified_at/updated_at lack @updatedAt (rely on app code -> stale-timestamp footgun); duplicate identical audit_logs created_at indexes (71,73); is_deleted absent on financial/document models (audit_logs compensates); invoice/order/project/quotation status are free strings not Prisma enums; config lists stored as LongText JSON not Json columns. Money is correctly Decimal throughout (good).

src/admin/ui/Alert.tsx

• [LOW] MUI close button gets default English aria-label "Close" amid otherwise-Czech UI (18). Clean otherwise.

src/admin/ui/AppShell.tsx

• [MEDIUM] setTimeout(()=>logout(),400) (27) is fire-and-forget, never cleared — fires on an unmounted tree if unmounted within 400ms.
• [LOW] Decorative inline SVGs lack aria-hidden. Otherwise clean.

src/admin/ui/Button.tsx

• Clean (sound polymorphic component pattern, caller sx wins).

src/admin/ui/Card.tsx

• [MEDIUM] Always wraps children in CardContent with no opt-out/contentProps — edge-to-edge content (media/table) can't use this primitive. Otherwise clean.

src/admin/ui/Checkbox.tsx

• [MEDIUM] No disabled/name/id/indeterminate/required passthrough — minimal API forces callers to raw MUI. Otherwise clean.

src/admin/ui/ConfirmDialog.tsx

• [MEDIUM] cancelText (and confirmVariant) not frozen in shown while title/message/confirmText/loading are — cancel label can flicker during the close fade. message is plain string (no XSS). Otherwise clean.

src/admin/ui/DataTable.tsx

• [MEDIUM] Mobile card branch (78-173) ignores sortBy/sortDir/onSort — sorting controls vanish on phones with no alternative.
• [LOW] Desktop action cells do NOT stopPropagation (237,254-275) — an action button in an onRowClick row fires BOTH (potential double-action; HIGH if any table pairs them). "actions" column key magically special-cased (undocumented). Status tints correctly channel-alpha.

src/admin/ui/DateField.tsx

• [LOW] Dual-label coexistence (picker label + outer Field); parseISO guarded by isValid. Clean.

src/admin/ui/EmptyState.tsx

• [LOW] icon sized via fontSize:48 — assumes font/SVG-inheriting glyph (an won't scale). Clean.

src/admin/ui/Field.tsx

• [HIGH] <Typography component="label"> (24) has NO htmlFor and injects no id into children — label not associated with the input (no click-to-focus, screen readers don't announce). System-wide since this is the shared form-label primitive.
• [MEDIUM] error/hint not linked via aria-describedby and input gets no aria-invalid (41-49). SwitchField lacks disabled passthrough.

src/admin/ui/FileUpload.tsx

• [LOW] Keys include array index; remove button uses entity glyph with proper aria-label. Clean.

src/admin/ui/FilterBar.tsx

• Clean.

src/admin/ui/LoadingState.tsx

• [LOW] CircularProgress has no accessible label when label omitted (the full-screen AppShell case). Clean otherwise.

src/admin/ui/Modal.tsx

• [MEDIUM] cancelText not frozen in shown (cancel label flickers on close); DialogContent renders LIVE children (77) so the form body still flashes its cleared state during the fade — the exact issue the freeze targets, unsolved for the body. Otherwise clean.

src/admin/ui/MonthField.tsx

• [LOW] ~90% duplicate of DateField.tsx (low-value to consolidate); parseISO guarded. Clean.

src/admin/ui/MuiProvider.tsx

• [LOW] defaultMode="dark" hardcoded (11); verify it agrees with ThemeContext's data-theme/mui-mode source of truth to avoid a one-frame mismatch. Clean otherwise.

src/admin/ui/PageEnter.tsx

• [LOW] Children keyed by index (animation only); useReducedMotion called before early return (hook order safe). Clean.

src/admin/ui/PageHeader.tsx

• Clean

src/admin/ui/Pagination.tsx

• Clean (clamps page, null for single page).

src/admin/ui/ProgressBar.tsx

• [LOW] Determinate LinearProgress has no accessible name (26).

src/admin/ui/RichText.tsx

• Clean — style-only styled("div"); never uses dangerouslySetInnerHTML. Verified both consumers (InvoiceDetail:1562, OrderDetail:760) DOMPurify-sanitize. No XSS.

src/admin/ui/Select.tsx

• [LOW] slotProps as {...} localized sound widening; spread order correct. Clean.

src/admin/ui/SidebarNav.tsx

• [LOW] Logo onError fallback relies on the fallback existing (no infinite loop). & svg {width:18} constraint documented; OdinMark overrides via wrapper + 70% !important (verified). Clean.

src/admin/ui/StatCard.tsx

• Clean — uses shared iconBadgeSx (solid tile + white glyph).

src/admin/ui/StatusChip.tsx

• Clean.

src/admin/ui/Tabs.tsx

• [LOW] TabPanel unmounts inactive content with no role="tabpanel"/aria-labelledby wiring (a11y-incomplete).

src/admin/ui/TextField.tsx

• Clean.

src/admin/ui/ThemeToggle.tsx

• Clean — single ThemeContext source; aria-label+title present.

src/admin/ui/TimeField.tsx

• [LOW] Module-level REF Date used read-only by date-fns (safe); validates via isValid. Clean.

src/admin/ui/index.ts

• Clean (barrel).

src/admin/ui/navData.tsx

• [LOW] Non-matchPrefix branch uses bare pathname.startsWith(item.path) (no boundary) — fragile if a /x-foo route is ever added (items needing exactness set end:true). Verbose inline SVG set.

src/admin/ui/useDialogScrollLock.ts

• [MEDIUM] Module-level lock state — production-safe (balanced [open] dep + cleanup), but a StrictMode/hot-reload double-invoke can transiently skew lockCount.
• [LOW] Stale comment references removed base.css (now GlobalStyles.tsx).

src/admin/pages/Warehouse.tsx

• [LOW] Dead/duplicated MovementRow type drift (75); redundant per-column ?? 0; cosmetic isLoading gating. Clean otherwise (read-only).

src/admin/pages/WarehouseCategories.tsx

• [MEDIUM] sort_order via parseInt(...)||0 no radix (308) — drops a legit 0 and truncates "3.9"->3; convention wants Number/NaN-guard.
• [LOW] Redundant saving state duplicates submitMutation.isPending. Broad ["warehouse"] invalidation correct.

src/admin/pages/WarehouseInventory.tsx

• [MEDIUM] items column renders s.items?.length ?? 0 (125) but list endpoint omits items -> always shows 0; should use a _count. Otherwise clean.

src/admin/pages/WarehouseInventoryDetail.tsx

• [HIGH] Rules-of-Hooks: return <Forbidden/> (70) precedes useApiMutation (72) -> hook-count mismatch crash on permission change.
• [LOW] .../0/confirm URL fallback is dead (handler guards null). Broad invalidation correct.

src/admin/pages/WarehouseInventoryForm.tsx

• [HIGH] Rules-of-Hooks: return <Forbidden/> (83) precedes useApiMutation (94).
• [MEDIUM] actual_qty via Number(e.target.value) no NaN guard (249) — clearing field -> NaN in payload (receipt/issue forms use parseDecimal). validate() doesn't check qty finite.

src/admin/pages/WarehouseIssueDetail.tsx

• [HIGH] Rules-of-Hooks: return <Forbidden/> (73) precedes useApiMutation (77,89).
• [MEDIUM] Project link uses raw <Typography component="a" href> (316-330) not RouterLink -> full-page reload, breaks SPA nav.
• [LOW] Dead /0/ URL fallbacks.

src/admin/pages/WarehouseIssueForm.tsx

• [HIGH] Rules-of-Hooks: return <Forbidden/> (267) precedes useApiMutation/useState (335,347).
• [MEDIUM] confirmIssue setState(id) then immediately await mutateAsync; the url: closure reads pre-update id -> first confirm hits /0/confirm. Pass id as mutation variable.
• [LOW] Form-seeding effects (238,242) are effect-as-derived-state.

src/admin/pages/WarehouseIssues.tsx

• Clean (kit, FilterBar, PageEnter, debounce, _count.items, keys).

src/admin/pages/WarehouseItemDetail.tsx

• [HIGH] Rules-of-Hooks: return <Forbidden/> (157) precedes useApiMutation (164,180).
• [MEDIUM] Error-handling effect navigates away (148-153) — effect-as-control-flow (could be a render branch).
• [LOW] Form-seed logic duplicated 3x (128/132/248-261); useModalLock(editing) (155) locks page scroll for an in-page (non-modal) edit form — likely unintended.

src/admin/pages/WarehouseItems.tsx

• Clean (kit, FilterBar, useTableSort, debounce, keys, rowInactive).

src/admin/pages/WarehouseLocations.tsx

• [LOW] toggleMutation toasts in handler not onSuccess (inconsistent); dead czechPlural ternary. Guard correctly after hooks. Clean otherwise.

src/admin/pages/WarehouseReceiptDetail.tsx

• [HIGH] Rules-of-Hooks: return <Forbidden/> (97) precedes useApiMutation (101,113,126).
• [LOW] Dead /0/ URL fallbacks; attachment link safe (noopener). Broad invalidation correct.

src/admin/pages/WarehouseReceiptForm.tsx

• [HIGH] Rules-of-Hooks: return <Forbidden/> (203) precedes useApiMutation/useState (269,281).
• [MEDIUM] Same stale-closure confirm bug as IssueForm (307-309) -> /0/confirm on first confirm.
• [LOW] Uses imperative document.createElement input + hand-rolled dropzone instead of kit FileUpload (620-633).

src/admin/pages/WarehouseReceipts.tsx

• Clean (kit, FilterBar, debounce, _count.items, keys).

src/admin/pages/WarehouseReports.tsx

• [MEDIUM] Project-consumption & movement-log tabs fetch via raw apiFetch + useState (263-290,386-413) not React Query — results NOT in ["warehouse"] cache, won't refresh on mutations; existing query options unused.
• [LOW] Duplicated MovementLogRow type (46); empty catch {} -> setData([]) swallows fetch errors (285,408); raw row.date not formatDate'd (426).

src/admin/pages/WarehouseReservations.tsx

• [MEDIUM] Create & cancel use raw apiFetch + manual invalidate (170-217) not useApiMutation (broad key correct, but plumbing duplicated).
• [LOW] Empty catches don't log; quantity via Number() no NaN guard (457) and NaN<=0 is false so NaN can be submitted.

src/admin/pages/WarehouseSuppliers.tsx

• [MEDIUM] toggleActive setState(id) then immediate await mutateAsync — url: closure reads null id -> PUT hits the collection root (wrong endpoint) on first toggle. Pass id as mutation variable.
• [LOW] Redundant saving state. Guard correctly after hooks. Clean otherwise.

src/admin/pages/Attendance.tsx

• [MEDIUM] calculateBusinessDays parses YYYY-MM-DD via new Date() (UTC midnight) + local getDay() (480-488) — can mis-count business days in the evening Prague window.
• [LOW] leaveRequestMutation invalidates attendance/leave-requests/users but NOT ["leave"] (303) — approver's pending queue (["leave","pending"]) won't auto-refresh; live clock (676) never ticks; notes synced via effect can clobber unsaved edits (336-340). todayLocalStr used (good).

src/admin/pages/AttendanceAdmin.tsx

• Clean (thin presenter over useAttendanceAdmin).

src/admin/pages/AttendanceBalances.tsx

• [HIGH] Rules-of-Hooks: return <Forbidden/> (171) precedes useApiMutation (173,189).
• [LOW] parseFloat on vacation/sick fields -> NaN on empty (770,781,794) into payload.

src/admin/pages/AttendanceCreate.tsx

• [LOW] leave_hours: parseFloat() -> NaN on cleared field (190). todayLocalStr used; broad invalidation. Clean otherwise.

src/admin/pages/AttendanceHistory.tsx

• [MEDIUM] ~865-line file with inline print-HTML template + hidden print JSX — split candidate.
• [LOW] Duplicates holiday/business-day logic that also exists in attendanceHelpers (84-149). normalizeDateStr used; hooks before guard. Clean otherwise.

src/admin/pages/AttendanceLocation.tsx

• [LOW] Dead LoadingState branch (199 unreachable, !record returns null at 187 while pending). Popup via createElement/textContent (no XSS); Leaflet cleanup correct. Clean.

src/admin/pages/AuditLog.tsx

• [HIGH] Rules-of-Hooks: return <Forbidden/> (185-187) precedes useApiMutation (189).
• keepPreviousData, FilterBar, broad invalidation, shared ENTITY_TYPE_LABELS. Otherwise clean.

src/admin/pages/CompanySettings.tsx

• [MEDIUM] ~1503-line file — split candidate (info/banking/numbering/currency-VAT/logo cards).
• [MEDIUM] Uses deprecated MUI inputProps (1312) — silently ignored in v7 so min/step not applied (rest of file uses slotProps.htmlInput).
• [LOW] Doesn't wrap in PageEnter (raw motion.div per card — intentional embedded mode); fieldOrder index logic fragile. Blob cleanup correct.

src/admin/pages/Dashboard.tsx

• [LOW] DashData hand-rolled with [key]:unknown index sig + as DashData cast (76,88) bypasses query typing; 2FA handlers use raw apiFetch + manual invalidate (179-211) not useApiMutation. getCzechDate used (good); gated sections. Clean otherwise.

src/admin/pages/InvoiceDetail.tsx

• [MEDIUM] ~2243-line file — split candidate (SortableInvoiceRow / paid read-only view / create-edit form).
• [MEDIUM] UTC anti-pattern new Date(...).toISOString().split("T")[0] for due_date default (494), issue/due/tax dates (645-651) and computedDueDate (818-823) — the latter reaches the saved payload (977), persisting a day-early due date in evening Prague.
• [LOW] Editable notes state never wired to an input in non-paid mode (only form.notes saved) — confirm intended. DOMPurify correctly applied before the one dangerouslySetInnerHTML (1562) — no XSS. Money math guarded; blob cleanup correct.

src/admin/pages/Invoices.tsx

• [LOW] handleDelete/toggleStatus/handlePdf use raw apiFetch + manual invalidate (broad keys, correct behavior, off-convention); overdue rowSx UTC-vs-local compare off by a day near midnight (506-507, visual only). Clean otherwise.

src/admin/pages/LeaveApproval.tsx

• [HIGH] Rules-of-Hooks: return <Forbidden/> (158) precedes useApiMutation (160,173).
• Broad invalidation on leave-requests/leave/attendance/users; reject requires note. Otherwise clean.

src/admin/pages/LeaveRequests.tsx

• Clean — all hooks (useApiMutation:84) precede the guard (97); broad invalidation; truncation via title attr.

src/admin/pages/Login.tsx

• [LOW] verify2FA(loginToken!, ...) non-null assertion (105) — a null token (server returns requires2FA w/o token) would pass null!. Otherwise secure: tokens via useAuth, no persisted token state, TOTP input strips non-digits, autoComplete=one-time-code, renders outside AppShell.

src/admin/pages/NotFound.tsx

• Clean.

src/admin/pages/Odin.tsx

• Clean (permission gate + OdinChat; PageEnter wrap).

src/admin/pages/OfferDetail.tsx

• [HIGH] Heartbeat effect (730) deps omit isCompleted though the guard reads it (731) — lock heartbeat keeps running after transition to dokoncena (stale closure).
• [MEDIUM] ~2059-line file — split candidate (SortableItemRow / scope-sections / draft logic).
• [LOW] payload: any (884) and item-update casts; parseInt/parseFloat on qty/price yield NaN on cleared field (rendered until totals guard). Broad invalidation correct; draft parse guarded; blob revoked.

src/admin/pages/Offers.tsx

• [LOW] Expired check uses idiosyncratic new Date(new Date().toDateString()) (658, functional). Otherwise clean (broad keys, kit, blob revoke, keys).

src/admin/pages/OffersCustomers.tsx

• [LOW] parseInt without radix on key.split("_")[1] (239,259,675, harmless decimal). Otherwise clean (custom-field re-key correct, broad invalidation, a11y).

src/admin/pages/OffersTemplates.tsx

• [LOW] openEdit fetches via raw apiFetch (bypasses RQ cache) for on-demand modal. Guard is before a hooks-free body (no violation). Otherwise clean.

src/admin/pages/OrderDetail.tsx

• [CRITICAL] Rules-of-Hooks: 3 useApiMutation (181,187,193) AFTER return <Forbidden/> (179) — crash when orders.view absent / permission flips.
• [LOW] valid_transitions?.filter(...).length! > 0 (466) misleading non-null assertion. Section rich text DOMPurify-sanitized before dangerouslySetInnerHTML (760) — no XSS. Broad invalidation; blob cleanup.

src/admin/pages/Orders.tsx

• [LOW] vat_rate sent as raw string in JSON create (272, relies on Zod coercion). Otherwise clean — Forbidden return (312) after all hooks; broad invalidation; keys.

src/admin/pages/PlanWork.tsx

• [LOW] Several mutation callbacks use body: any/data: any (185,395,412,476,491). isoDate toISOString().slice(0,10) is correct (Plan UTC convention, not a finding). Forbidden return after hooks; pulse timer cleaned; todayIsoLocal used. Clean otherwise.

src/admin/pages/ProjectDetail.tsx

• [CRITICAL] Rules-of-Hooks: 4 useApiMutation (179,194,203,209) AFTER return <Forbidden/> (177).
• [LOW] formatNoteDate duplicates utils/formatters date logic. Broad invalidation (projects/warehouse); keys.

src/admin/pages/Projects.tsx

• [LOW] List query uses raw search not debounced (219) — every keystroke refetches (Offers/Orders debounce). Hooks (useApiMutation 124,173) precede the guard (222) — correct ordering. Broad invalidation; keys.

src/admin/pages/ReceivedInvoices.tsx

• [MEDIUM] toDateInput uses toISOString().split("T")[0] (453) to seed edit-form dates — forbidden UTC-split (day-early evening Prague). Use normalizeDateStr.
• [MEDIUM] ~1237-line file — split candidate (upload modal + edit modal).
• [LOW] Render-phase ref mutation hasLoadedOnce.current=true (279); loose parseFloat typing (557). VAT-from-gross preserved; broad invalidation; blob cleanup.

src/admin/pages/Settings.tsx

• [HIGH] Rules-of-Hooks: 5 useApiMutation (319,339,354,372,390) AFTER return <Navigate/> (315) — useQuery/useMemo/useState are above, mutations are not.
• [MEDIUM] ~1354-line file — split candidate (roles / system-settings / system-info).
• [LOW] systemInfo as Record<string,any> (679); O(n^2 log n) permission-group sort (1243, negligible). Tab state derived from URL (good); broad invalidation.

src/admin/pages/Trips.tsx

• [HIGH] Rules-of-Hooks: 2 useApiMutation (190,204) AFTER return <Forbidden/> (188).
• [LOW] Dead [,setLastKm] state (186, only setter used); parseInt without radix (287,315-316). todayLocalStr used; broad invalidation (trips/vehicles); keys.

src/admin/pages/TripsAdmin.tsx

• [HIGH] Rules-of-Hooks: 2 useApiMutation (236,255) AFTER return <Forbidden/> (231).
• [LOW] handlePrint uses raw printWindow.document.write of app data (344-417) — low XSS surface (React-escaped innerHTML) but fragile; iframe/template safer. Broad invalidation; keys.

src/admin/pages/TripsHistory.tsx

• [LOW] totals computed before the Forbidden return (wasteful when unauthorized) — but all hooks precede the return (no violation). Read-only; kit; keys. Clean.

src/admin/pages/UiKit.tsx

• Clean (dev-only showcase).

src/admin/pages/Users.tsx

• [HIGH] Rules-of-Hooks: 3 useApiMutation (126,152,162) AFTER return <Forbidden/> (173).
• [LOW] roles[0]?.id ? ... : "" default would skip a role id of 0 (never 0 in practice). Shared broad USER_INVALIDATE array (good); self-deactivation guarded; keys.

src/admin/pages/Vehicles.tsx

• [HIGH] Rules-of-Hooks: 3 useApiMutation (121,136,146) AFTER return <Forbidden/> (162).
• [LOW] Raw MUI <Chip> instead of kit StatusChip (264); select: data as unknown as Vehicle[] double-cast (100); parseInt without radix (404). Broad invalidation (vehicles/trips); rowInactive; keys.

src/admin/components/AlertContainer.tsx

• [LOW] Stacking offset keyed off array index (15) — removing a middle alert reflows/can overlap with 3+ alerts. Keys use alert.id. Otherwise clean.

src/admin/components/AttendanceShiftTable.tsx

• [LOW] Project-cell key falls back to index when log.id nullish (119); duration math not memoized. Otherwise clean (no any, keys, no effects).

src/admin/components/BulkAttendanceModal.tsx

• [LOW] Select-all label shows "Odznacit vse" when users empty (BulkPlanModal guards this — inconsistent). Otherwise clean.

src/admin/components/BulkPlanModal.tsx

• Clean (kit, derived activeCategories, keys, select-all guarded, no any).

src/admin/components/ErrorBoundary.tsx

• [LOW] componentDidCatch only console.errors (22) — no telemetry hook. Correct boundary pattern otherwise.

src/admin/components/Forbidden.tsx

• Clean.

src/admin/components/OrderConfirmationModal.tsx

• [MEDIUM] Local state (step/items/applyVat/lang) never reset on reopen — component is permanently mounted, toggled by isOpen; reopening shows prior step/edits and items captured once via useState(initialItems) go stale.
• [MEDIUM] finally closes the modal even when onGenerate throws (58-77) — a generation error drops edited items with only a transient toast.
• [LOW] Editable rows key={i} — deleting a non-last row shifts indices (focus jumps; data stays correct since controlled).

src/admin/components/PlanCategoriesModal.tsx

• [LOW] Label TextField uncontrolled defaultValue with no key={c.label} (148) — won't re-seed on external rename (color input does add key); inline delete-confirm instead of kit ConfirmDialog. Broad ["plan","dashboard","audit-log"] invalidation correct; onBlur-commit.

src/admin/components/PlanCellModal.tsx

• [MEDIUM] Props onSaveEntry/onUpdateEntry/onSaveOverride/onUpdateOverride typed any (77-82) — untyped save payloads on the most bug-prone path.
• [LOW] EditForm derives state from initial via useState (201-206) relying on parent remount per record (no key reset — fragile if parent swaps entryId same-kind); odd Czech phrasing (415). Discriminated-union mode + kit otherwise strong.

src/admin/components/PlanGrid.tsx

• [LOW] projects.find(...) inside per-cell render loop (612-616) O(daysuserscells*projects) — build a useMemo Map (rarely hit since server embeds label); eachDay/days recomputed every render (not memoized). todayIso uses local Y/M/D (correct); thorough aria-labels.

src/admin/components/PlanRangeChips.tsx

• [LOW] readonly prop accepted then discarded via void readonly (17) — dead prop (PlanGrid still passes it). className styling intentional (classes defined in PlanGrid root). Otherwise clean.

src/admin/components/ProjectFileManager.tsx

• [MEDIUM] Drag-over has no drag-depth counter — handleDragLeave (377-380) fires on every child boundary -> drop overlay flickers during drag.
• [MEDIUM] File ops use raw apiFetch + manual invalidate of sub-key ["projects",id,"files"] (349-351) not broad ["projects"] (deliberate scope, documented deviation).
• [LOW] catch {} substitutes a generic toast but never logs the real error (336,408,438,471,508); sequential per-file upload; breadcrumb join breaks if a folder name contains "/". Escape/Enter handling + canManage gating correct.

src/admin/components/RichEditor.tsx

• [LOW] _delta: any on the Quill onChange param (91, react-quill-new loose types — could be unknown); useLayoutEffect font-set no-ops if ref not ready (mounts sync in practice). Never injects HTML — consumers DOMPurify-sanitize. No XSS.

src/admin/components/ShiftFormModal.tsx

• [MEDIUM] leave_hours via parseFloat (330-331) writes NaN to form state on empty input — serializes to invalid; should fall back to 0 like the Number(...)||0 pattern.
• [LOW] Module-level mutable _logKeyCounter (20) shared across instances (fragile under StrictMode/concurrent instances) — use a per-instance ref/randomUUID; server-loaded logs may lack _key -> index-key risk. Derived isWorkType/isCreate + kit otherwise correct.

src/admin/components/ShortcutsHelp.tsx

• [LOW] Entire component is return null — dead stub; remove the file + references, or wire it up.

src/admin/components/dashboard/DashActivityFeed.tsx

• Clean (escaped React children, single-source ENTITY_TYPE_LABELS).

src/admin/components/dashboard/DashAttendanceToday.tsx

• [LOW] Key ${u.user_id}-${i} index-suffixed (75); user_id alone is unique. Clean.

src/admin/components/dashboard/DashKpiCards.tsx

• [LOW] buildKpiCards recomputed every render (124, cheap); framer-motion entrance has no reduced-motion branch (JS-driven animate not stopped by the GlobalStyles CSS reset) — applies to DashQuickActions/DashProfile/DashSessions too. Clean otherwise.

src/admin/components/dashboard/DashProfile.tsx

• [MEDIUM] handleSubmit (175-197) uses raw apiFetch and invalidates NO React Query domain after a profile PUT — anything keyed on user data goes stale.
• [LOW] delete (dataToSave as any).current_password casts (172-173); magic 300ms sleep before success toast (189); no reduced-motion branch.

src/admin/components/dashboard/DashQuickActions.tsx

• [HIGH] handleTripSubmit (157-176) POSTs a trip via raw apiFetch and NEVER invalidates ["trips"]/["dashboard"] (no useQueryClient imported) — list/dashboard stay stale until manual refetch.
• [MEDIUM] result from .json() untyped any (96,116,164); last_km assigned into a string field with no String() coercion.
• [LOW] Empty catches don't log (104-106,120-122); parseInt without radix. tripDistance derived (good); todayLocalStr used.

src/admin/components/dashboard/DashSessions.tsx

• [LOW] Correctly invalidates ["sessions"]; shared deleting flag (one dialog at a time); no reduced-motion branch. Clean.

src/admin/components/dashboard/DashTodayPlan.tsx

• [LOW] key={i} on plans (96, tiny static list); color-mix bgcolor (43, modern-browser only). Clean.

src/admin/components/odin/InvoiceReviewCard.tsx

• Clean (escaped fields, typed props, no XSS).

src/admin/components/odin/OdinChat.tsx

• [LOW] saveInvoice invalidates ["invoices"] (353) — broad key DOES cover received invoices (keyed ["invoices","received"]), so correct; persist() is fire-and-forget (failure only console.error, user not told history unsaved). Seed/auto-scroll effects are legitimate. Invoice-only guard correct.

src/admin/components/odin/OdinComposer.tsx

• [LOW] fileRef as RefObject<HTMLInputElement> unnecessary cast (48); Enter-to-send calls onSubmit even when !canSubmit (parent re-guards — no double-send). Clean.

src/admin/components/odin/OdinMark.tsx

• Clean — reduced-motion branch correct (opacity glow + documented !important); shouldForwardProp filters thinking/reduce.

src/admin/components/odin/OdinSidebar.tsx

• [LOW] Conversation row is a clickable (128) — not a button/no role/tabIndex, so not keyboard-focusable (a11y gap); kebab has aria-label. Clean otherwise.

src/admin/components/odin/OdinThread.tsx

• [LOW] Bubble key={i} (174, append-only so stable); content via Typography pre-wrap (no XSS); reduced-motion gated. Clean.

src/admin/components/odin/types.ts

• Clean

src/admin/components/warehouse/ItemPicker.tsx

• [MEDIUM] useQuery(warehouseItemListOptions({search: inputValue})) fires on EVERY keystroke with no debounce (30-32) — request spam; useDebounce hook exists. renderOption correctly extracts key (good).

src/admin/components/warehouse/ReservationPicker.tsx

• [MEDIUM] On item/project change, if the selected value is no longer in reservations, the component doesn't reset/notify the parent — parent can hold a stale reservationId. Redundant Number() casts (41,49). Typed (no any).

src/admin/AdminApp.tsx

• [LOW] No RequireAuth wrapper visible in the router — auth gating delegated to AppShell/pages (a new top-level route outside AppShell would be public by default); Dashboard eagerly imported (not lazy) (13). Clean otherwise.

src/admin/GlobalStyles.tsx

• Clean.

src/admin/theme.ts

• [LOW] containedPrimary hover/active transform lacks a prefers-reduced-motion guard present on MuiButton.root/MuiOutlinedInput (89-95); iconBadgeSx key cast loses type-safety (248, behavior fine). Clean otherwise.

src/admin/theme.test.ts

• [LOW] Heavy as any/as unknown as ... to reach theme internals (deliberate test shortcut). Clean.

src/App.tsx

• [LOW] AdminLoader reads data-theme once at render — dark fallback on cold load before ThemeContext sets it (acceptable). Clean otherwise.

src/main.tsx

• Clean.

src/vite-env.d.ts

• Clean.

src/context/ThemeContext.tsx

• [MEDIUM] Theme single-source is correct (mui-mode only; legacy boha-theme read-once-then-deleted) BUT the "dark" default is hardcoded twice (here:30 and MuiProvider.tsx:11) — change one without the other and page (MUI) vs toggle desync on first paint; reconcile to one constant.
• [LOW] No storage event listener — two tabs won't sync theme until reload. View-Transition/flushSync + reduced-motion fallback correct.

src/admin/context/AlertContext.tsx

• Clean (timeouts tracked in a ref Set, cleared on unmount; counter ref avoids key collisions; split state/methods contexts).

src/admin/context/AuthContext.tsx

• [MEDIUM] apiRequest (318-350) duplicates the refresh+retry logic of utils/api.ts apiFetch — two parallel 401-retry paths with DIVERGENT behavior (apiRequest ignores abort signals and doesn't set the session-expired flag). Consolidate onto apiFetch.
• [MEDIUM] Proactive-refresh timer fires a closure-captured silentRefresh (memoized [] + eslint-disable, 117-125); works only because everything is read through refs — fragile cyclic setup.
• [LOW] In-flight refresh not cancelled on logout (a resolving refresh could re-setUser); checkSession maps user twice (181-182). Token held in-memory only (secure). Dedup + expires_in proactive refresh otherwise correct.

src/admin/utils/api.ts

• [LOW] Module-singleton state with injected getTokenFn/refreshFn couples a module global to React lifecycle (resetApiState for tests); on a 401 with aborted signal returns the 401 response not the 499 sentinel used elsewhere (inconsistent); its refreshPromise dedup is a second single-flight layer alongside AuthContext's. Up-front refresh/abort/FormData handling correct.

src/admin/utils/attendanceHelpers.ts

• [MEDIUM] getTimePart (105-109) uses new Date(datetime).getHours() (TZ-dependent) while sibling extractTime parses the string to avoid TZ conversion — can yield a different hour than displayed at DST/offset edges, violating the file's own stated ethos.
• [LOW] getLeaveTypeBadgeClass returns badge-* classes that exist only in AttendanceHistory's print <style> (near-dead as a general helper); calculateNightMinutes mixes timestamp windows with local-midnight math (Prague-TZ-coupled).

src/admin/utils/dashboardHelpers.ts

• [MEDIUM] STATUS_DOT_CLASS (7-12) is exported but referenced by ZERO files and maps to dash-status-* CSS classes removed in the MUI migration — dead code.
• [LOW] getCzechDate ISO-week calc (59-62) is the naive formula (off-by-one near year boundaries, display-only). Other exports live/correct.

src/admin/utils/formatters.ts

• Clean (todayLocalStr avoids the UTC slice trap; formatCurrency locale-correct).

src/admin/hooks/useAttendanceAdmin.ts

• [HIGH] ~1402-line file mixing the React hook, computeUserTotals payroll math, and ~370 lines of print-HTML templating — the two pure modules have no React dep and should be extracted to utils/ for testability.
• [HIGH] Does data fetching with useEffect+useState+manual setLoading (818-922) against the "React Query for fetching" convention, AND also invalidateQueries(["attendance"]) after mutations — two sources of truth (its own fetchData cache vs the ["attendance"] domain).
• [MEDIUM] fetchData useCallback closes over alert (captured first render) with eslint-disable + initialLoadDone ref; pervasive Record<string,any>/any in print/payroll helpers (350,380,597,1319); 300ms sleeps before success toasts as a sync crutch.
• [LOW] handlePrint document.write of escaped data; today/now recomputed every render.

src/admin/hooks/useDebounce.ts

• Clean.

src/admin/hooks/useModalLock.ts

• [LOW] Module-level activeLocks counter locks only document.body.style.overflow (3-7) — CLAUDE.md says dialogs must lock <html> (via useDialogScrollLock) because html{overflow-x:hidden} makes <html> the scroller; this body-only lock likely doesn't prevent background scroll for the app layout (superseded/near-dead — confirm callers).

src/admin/hooks/usePaginatedQuery.ts

• [LOW] options: any param (24, eslint-disable) loses generic typing; as UseQueryOptions<...> unchecked. Clean otherwise.

src/admin/hooks/usePlanWork.ts

• [MEDIUM] Optimistic rollback stashed via (createEntry as any)._rolled = rolled (264,332,369,403,454,481) — mutating the TanStack mutation object is non-idiomatic and NOT concurrency-safe (two in-flight mutations overwrite each other's _rolled → wrong-snapshot rollback). Use onMutate context.
• [MEDIUM] Heavy any on mutationFn/onSuccess (237,243,379,385,491); gridQuery.queryFn does r.json() with no res.ok check (92-94) — treats an error body as undefined data.
• [LOW] isoDate UTC slice is correct for Plan, but anchor seeded from a LOCAL new Date() then read with getUTC* (27-31,70,80-86) — verify the late-evening Prague window doesn't shift the week/month anchor. keepPreviousData + broad invalidation correct.

src/admin/hooks/useReducedMotion.ts

• [LOW] setReduced(false) initial then reconciles in effect — one render with motion for reduced-motion users (documented intentional; a lazy matchMedia initializer would avoid the flash). Listener add/remove correct.

src/admin/hooks/useTableSort.ts

• Clean (default-vs-user sort distinguished; stable callback).

src/admin/lib/apiAdapter.ts

• [LOW] paginatedJsonQuery fallback uses per_page=items.length, total_pages=1 when server omits pagination (74-80) — masks a missing-meta bug; result.data as T/items as T[] unchecked (by design). 401/success/error handling correct.

src/admin/lib/entityTypeLabels.ts

• Clean — all 29 server EntityType members present and Czech-labeled; single source intact.

src/admin/lib/queryClient.ts

• Clean — staleTime 30s, gcTime 5min, retry 1, sane defaults.

src/admin/lib/queries/ai.ts

• [LOW] Singular/plural key split: list ["ai","conversations"] vs messages ["ai","conversation",id,"messages"] — a broad ["ai","conversations"] invalidation won't touch open threads (intended; relies on staleTime Infinity/gcTime 0 to refetch on mount). Correct.

src/admin/lib/queries/attendance.ts

• [MEDIUM] attendanceLocationOptions (166-185) bypasses jsonQuery: reads result.data.record||result.data from untyped response.json() with NO response.ok/401 guard — a 500/non-JSON throws an opaque error instead of the adapter's normalized one.
• [LOW] historyOptions hardcodes limit=1000 in the queryFn (not in the key). Keys unique per action/year; enabled:!!id correct.

src/admin/lib/queries/auditLog.ts

• [LOW] queryFn returns Record<string,unknown>[] rows (23-26) — untyped; consumers cast to AuditLogEntry[] at the page. Key ["audit-log",filters] consistent with broad invalidation.

src/admin/lib/queries/common.ts

• Clean — ["bank-accounts"]/["suppliers"] distinct broad keys, 2-min staleTime; suppliers invalidated by ReceivedInvoices.

src/admin/lib/queries/dashboard.ts

• [MEDIUM] sessionsOptions (27-38) hand-rolls fetch with untyped json() and no response.ok/401 guard before reading data.success — inconsistent with jsonQuery.
• [LOW] dashboardOptions returns Record<string,unknown> (untyped payload). Keys broad/unique.

src/admin/lib/queries/invoices.ts

• [LOW] receivedInvoiceListOptions (157-169) manually lists filter fields into the key instead of spreading filters — a new filter silently won't bust the cache (inconsistent with invoiceListOptions); ["invoices",id] shares prefix with list/stats/received (no real collision). NOTE: received invoices ARE under ["invoices","received"], so a broad ["invoices"] invalidation covers them.

src/admin/lib/queries/leave.ts

• [LOW] Two key families for one entity: ["leave-requests","mine"/"all"] vs ["leave","pending"/"processed"] — mutations invalidate both domains (consistent) but it's avoidable duplication that's easy to under-invalidate later; rows typed Record<string,unknown> despite a LeaveRequest interface in-file.

src/admin/lib/queries/mutations.ts

• [LOW] invalidate() loops single top-level string keys (100-104) — can't express a multi-segment broad key (fine for current usage); onSuccess user override force-cast hides signature mismatch. ApiError.status/401 sentinel/broad-invalidation default correct.

src/admin/lib/queries/offers.ts

• [LOW] offerListOptions (90) omits the on paginatedJsonQuery → rows are unknown (the only list option missing its generic); retry:false on detail justified/documented.

src/admin/lib/queries/orders.ts

• [LOW] orderListOptions (75) also omits → unknown rows; same theoretical id-vs-literal key note.

src/admin/lib/queries/plan.ts

• Clean — planKeys factory gives structured collision-free keys; helpers pure and used; broad ["plan"] invalidation covers sub-keys.

src/admin/lib/queries/projects.ts

• [LOW] projectFilesOptions treats HTTP 404 as empty result (97-99, reasonable but undocumented divergence from jsonQuery). Keys safe.

src/admin/lib/queries/settings.ts

• Clean — distinct keys; 5-min staleTime; require2FAOptions canonical (dashboard duplicate removed).

src/admin/lib/queries/trips.ts

• [LOW] tripListOptions and tripHistoryOptions hit the SAME endpoint under two key families (redundant cache); tripVehiclesOptions duplicates vehicleListOptions (same /vehicles endpoint cached twice — both invalidated correctly, verified). Redundant footprint only.

src/admin/lib/queries/users.ts

• [LOW] userListOptions key ["users",{permission}] fans out cache per-permission (a ["users"] mutation invalidates all via prefix — fine). Clean otherwise.

src/admin/lib/queries/vehicles.ts

• [LOW] Returns Record<string,unknown>[] (untyped; consumers cast). Broad ["vehicles"] key invalidated correctly.

src/admin/lib/queries/warehouse.ts

• [LOW] Detail keys ["warehouse",entity,id] share prefix with list (no collision); locationListOptions defaults filters in two places that must stay in sync (251-253); undefined filter segments in stock-status/movement-log keys. Every mutation invalidates broad ["warehouse"] (verified).

src/tests/ai.test.ts

• [MEDIUM] Budget-block test inserts cost_usd=budget+1 cleaned only in afterAll — inflates getMonthSpendUsd for other current-month tests in the file (order-safe today, fragile); "sums only current month" asserts spend<6 relying on no other current-month rows.
• [LOW] Configured chat path + the text-only canned-reply guard are untested (avoids API spend — acceptable); duplicated buildApp/token helpers; ai.use grant migration not exercised (relies on admin bypass).

src/tests/auth.service.test.ts

• [HIGH] Only failure/null branches of verifyAccessToken tested — the happy path (valid token → loadAuthData → AuthData) has ZERO coverage.
• [LOW] hashToken tests don't pin a known vector (a silent algo change staying 64-hex deterministic would pass).

src/tests/auth.test.ts

• [HIGH] No successful-login test — the whole happy path (tokens issued, refresh cookie set, 2FA loginToken branch) untested; only 401/400 negatives.
• [MEDIUM] /refresh only tests the no-token 401 — success/rotation and expired/invalid paths untested (security-critical).
• [LOW] Logout asserts only statusCode<500, never that the refresh cookie is cleared (name overstates the assertion).

src/tests/customers.schema.test.ts

• [MEDIUM] Trivial: only name empty/valid + one partial update; no NaN-coercion, email/ICO/DIC format, or nullable-field coverage.

src/tests/env.test.ts

• [LOW] Asserts shape only, never the validation FAILURE path (missing/short secret, bad port) which is the point of env validation.

src/tests/exchange-rates.test.ts

• [HIGH] Module-level rateCache/rateCacheTime never reset between tests (beforeEach resets only mockFetch) — the "throws when API fails and no cache" test passes only because it happens to run before the cache is populated; order-dependent/brittle.
• [MEDIUM] Conversion tests share the uncleared cache — once "today" is cached, later mockFetch resolutions are ignored on hit, asserting stale rates (false confidence).
• [LOW] No test for the amount!=1 path (CNB rates per 100 units, e.g. JPY/HUF) where rate/r.amount matters — the most money-bug-prone branch is untested.

src/tests/helpers.ts

• [LOW] extractCookie splits on first "=" via split("=")[1], truncating base64/JWT values containing "=" (latent; no caller exercises it); response: any.

src/tests/invoices.service.test.ts

• [MEDIUM] Inputs use duck-typed {toNumber:()=>N} stand-ins, not real Prisma.Decimal — a regression in real-Decimal handling wouldn't be caught; the "null quantity" test (40) actually passes 0, not null (name lies).
• [MEDIUM] No apply_vat:true with mixed per-line vat_rate, no currency-conversion, no negative/discount line — narrow surface for money logic.

src/tests/manual-create.test.ts

• [MEDIUM] afterEach deleteManys number_sequences type="shared" (16) — destructive shared global state also used by numbering.test.ts (serialized so safe, but resets the live shared counter).
• [LOW] Assertions guard with if (!("id" in res)) return; (37,50,116,132) — a failed create silently passes the test; attachment test checks only name+truthiness, not size/content.

src/tests/nas-file-manager.test.ts

• [LOW] Only traversal REJECTIONS tested (moveItem destination path not tested; "rejected" asserts a substring without confirming nothing was deleted/moved); no positive "legitimate path accepted" test (a reject-everything bug would pass).

src/tests/nas-project-folder.test.ts

• Clean

src/tests/numbering.test.ts

• [MEDIUM] Skip-taken preview tests assume a fresh counter, but real projects/quotations rows in the test DB may already hold the first number — second!==first can pass for the wrong reason / the create could collide on the unique column.
• [LOW] "increments" asserts only num1!==num2 (not strictly +1 / year/format preserved); NO concurrency test for the SELECT...FOR UPDATE path the whole fileParallelism:false workaround exists to protect.

src/tests/plan.test.ts

• [MEDIUM] noPermUserId is "second user in DB" reused for two meanings across two beforeAlls; if the DB has only one user it falls back to admin and the scoping assertion toEqual([]) is wrong-for-the-right-reason masked.
• [LOW] Far-future created_at (2037) to dodge the 2038 ceiling (brittle); updateEntry doesn't test inactive/unknown category or date_from>date_to; assertNotPastDate "today" boundary (the bug-prone path) untested.

src/tests/planAuditDescription.test.ts

• Clean

src/tests/planCategory.test.ts

• [MEDIUM] Dedupe test asserts _2 but cleanup is keyed to in-memory ids (afterAll), so a mid-run crash leaves rows that make the next run assert _3 and fail (slug-prefix cleanup would be safer).
• [LOW] No duplicate-label-on-update negative test, no deactivate/reactivate test; slugify empty-result collision (slugify("***")→"") untested.

src/tests/received-invoices-vat.test.ts

• [LOW] Solid value checks but no half-cent rounding edge, no negative/credit-note amount; rounding pinned via toBeCloseTo rather than the stored 2-dp value.

src/tests/schema-nan.test.ts

• [MEDIUM] Proves "not-a-number" is rejected but never that a valid numeric STRING ("2") is coerced/accepted — the whole point of the form-coercion helper (string→number) is untested.
• [LOW] Only CreateOrder/CreateQuotation covered; the ~150 other duplicated coercion sites (invoices/received-invoices/trips/plan) have no NaN test.

src/tests/setup.ts

• [LOW] Loads .env.test but doesn't assert it exists or that DATABASE_URL targets a TEST db (vitest.config also loads it with override:true — redundant); a missing .env.test silently runs against whatever env is present (non-test-DB risk).

src/tests/warehouse.test.ts

• [MEDIUM] Shared counter for location codes + per-describe createdItemId/createdCategoryId in closure → tests within a describe are order-dependent (one early failure cascades).
• [LOW] "deactivates an item (soft delete)" actually asserts a HARD delete (404) — name lies and would mask a future intended soft-delete; FIFO verified only by summed batch quantity, never that the OLDEST batch is consumed first (core stock-valuation logic unverified); no partial-issue-across-batches / negative-qty rejection / reservation+issue-simultaneous-subtraction tests; hardcoded item_number "ITM001" + item_id:1 in a 403 test (fragile).

Suite-level (tests)

• [MEDIUM] Server-side only — ZERO frontend/component tests: React Query mutations, api.ts token-refresh/dedup, UI VAT/number formatting, and permission-gated rendering are entirely unverified.
• [LOW] buildApp/generateToken/no-perm-user bootstrap copy-pasted across ai/plan/warehouse tests instead of helpers.ts (~150 lines of drift-prone duplication).

index.html

• Clean — fonts (Newsreader incl.) preconnected; data-theme="dark" initial matches ThemeContext default; cache-control metas are belt-and-suspenders (largely ignored by browsers, harmless).

.claude/settings.json

• Clean — PreToolUse block-env + PostToolUse prettier hooks. (Prettier-not-a-declared-dep is captured at PROJECT-LEVEL.)

boneyard.config.json

• Clean — skeleton-generation config (boneyard); hardcoded sample routes (/orders/1, /projects/80) are dev capture targets.

.claude/settings.local.json

• [LOW] Permission allowlist contains stale entries pointing at the OLD PHP app (find ...boha-app ...*.php, lines 4-9) — harmless (gitignored, local-only) but dead config from the pre-rewrite project.

CLAUDE.md

• [LOW] Otherwise excellent and current (counts verified: 52 models, 17 test files/195 tests, 114 admin tsx). One doc-vs-code drift: it states vatFromGross (gross VAT) is used "by both the manual form and the AI import," but the JSON single-create path in received-invoices.ts still uses the net amount*rate/100 formula (see that file's [HIGH]) — the convention is documented as fully applied when one code path was missed. Strength worth preserving: the conventions section + the 2026-06-06 audit reference keep entropy in check.

Config & build files (assessed at PROJECT-LEVEL)

These were reviewed; their findings are consolidated in the PROJECT-LEVEL section (no linter, stale .env.example, test-typecheck gap, unpinned Prettier). Per-file notes:

package.json

• See PROJECT-LEVEL: no ESLint/Prettier devDeps; dead deps (react-datepicker, hi-base32, @types/mysql); majors behind. Scripts/structure otherwise clean.

tsconfig.json

• Clean — solution file referencing the server + app projects.

tsconfig.server.json

• [HIGH] Excludes src/__tests__ (with tsconfig.app.json not including it, tests are never type-checked — see PROJECT-LEVEL). strict:true, CJS/ES2022 correct otherwise.

tsconfig.app.json

• [MEDIUM] noUnusedLocals:false/noUnusedParameters:false (compiler won't flag dead code) and tests not included (not type-checked). strict:true, bundler resolution correct.

vite.config.ts

• Clean — react plugin, manualChunks for vendor splitting, es2020 target.

vitest.config.ts

• Clean — node env, .env.test override, fileParallelism:false (deliberate, documented), 15s timeouts.

.env.example

• [MEDIUM] Stale — missing many env vars config/env.ts reads (ANTHROPIC_API_KEY, NAS_FINANCIALS_PATH, NAS_OFFERS_PATH, SMTP_FROM_NAME, INVOICE_ALERT_EMAIL, RATE_LIMIT_, TRUST_PROXY, TOTP_). See PROJECT-LEVEL.

.claude/hooks/block-env.js

• Clean — blocks direct .env edits via PreToolUse.

.claude/hooks/format-on-save.js

• [LOW] Runs npx prettier --write but prettier is not a declared devDep and there's no .prettierrc (see PROJECT-LEVEL) — formatting is unpinned/non-reproducible.