> ## Documentation Index
> Fetch the complete documentation index at: https://system.muzemus.online/llms.txt
> Use this file to discover all available pages before exploring further.

# Known limitations

> Current system limitations, technical debt, and known gaps

This page is the single home for known limitations. Domain pages link here instead of repeating their own lists.

## Authentication and security

| Limitation                           | Impact                                           | Priority |
| ------------------------------------ | ------------------------------------------------ | -------- |
| No multi-factor authentication (MFA) | Account compromise gives full access             | High     |
| No account lockout                   | Brute-force attacks possible                     | High     |
| No CSP headers                       | XSS risk if React escaping is bypassed           | Medium   |
| No database-level RLS                | A service-layer bug could leak cross-client data | Medium   |
| No automated vulnerability scanning  | Known CVEs may go unnoticed                      | Medium   |
| No session rotation                  | Long-lived sessions widen the hijacking window   | Low      |
| No auth-event audit records          | Login/logout failures are not in the audit trail | Low      |

## Entitlement engine

| Limitation                            | Impact                                                                             | Priority |
| ------------------------------------- | ---------------------------------------------------------------------------------- | -------- |
| Single replacement cycle per rule set | No separate initial vs replacement quantities beyond the phase field on rule items | Medium   |
| No provisional entitlements           | Cannot grant temporary or exception-based entitlements                             | Low      |
| No entitlement history view           | Period consumption is auditable per order item but has no dedicated history screen | Low      |

## Orders

| Limitation                  | Impact                                                 | Priority |
| --------------------------- | ------------------------------------------------------ | -------- |
| No estimated delivery dates | Users cannot see expected delivery                     | Medium   |
| No shipment tracking        | No courier integration                                 | Medium   |
| No partial fulfilment       | Cannot ship part of an order                           | Low      |
| No order templates          | Common order configurations cannot be saved and reused | Low      |
| No CSV/batch order creation | Bulk ordering is limited to the multi-employee cart    | Low      |

## Notifications

| Limitation                  | Impact                                                  | Priority |
| --------------------------- | ------------------------------------------------------- | -------- |
| No push or SMS channels     | In-app and email only; WhatsApp reserved in schema      | Medium   |
| No notification preferences | Users cannot opt out of notification types              | Low      |
| No email retry on failure   | Failed sends are recorded in `EmailLog` but not retried | Low      |
| No delivery-status webhooks | Delivery cannot be confirmed beyond provider logs       | Low      |

## Reports

| Limitation                   | Impact                                                | Priority |
| ---------------------------- | ----------------------------------------------------- | -------- |
| No scheduled reports         | Users trigger report generation manually              | Medium   |
| No historical trend analysis | Reports show current state, not comparisons over time | Medium   |
| No custom report builder     | Fixed report types only                               | Low      |
| Client-side CSV generation   | Very large datasets are limited by browser memory     | Low      |

## Infrastructure

| Limitation                             | Impact                                           | Priority |
| -------------------------------------- | ------------------------------------------------ | -------- |
| No CI workflow wiring                  | Tests run locally; no automated PR gates         | High     |
| No uptime monitoring or error tracking | Downtime and errors surface only via dashboards  | High     |
| Backend deploys are manual             | `render.yaml` sets `autoDeploy: false` by design | Accepted |
| No log persistence                     | Render logs retained roughly 7 days              | Medium   |
| Render cold starts                     | 30 to 60 second wake-up after 15 minutes idle    | Medium   |

## Data management

| Limitation                    | Impact                                                                                                          | Priority |
| ----------------------------- | --------------------------------------------------------------------------------------------------------------- | -------- |
| Mixed delete semantics        | Domain records use `active` soft-delete flags; permanent delete removes rows outright, including dependent data | Medium   |
| No data archival              | Historical data accumulates without cleanup                                                                     | Low      |
| No GDPR-style data export     | Cannot export all data for one employee                                                                         | Low      |
| No audit-log retention policy | Audit records grow indefinitely                                                                                 | Low      |

## Technical debt

| Debt                                     | Location                                                  | Impact                                                      |
| ---------------------------------------- | --------------------------------------------------------- | ----------------------------------------------------------- |
| Legacy `Role.EMPLOYEE` self-service path | Backend auth/entitlement code, `Employee.userId` relation | Scheduled for removal in Phase 11.9; must not be built upon |
| Test mocks typed as `any`                | Backend `*.spec.ts` files                                 | Production code unaffected; typed mocks deferred            |
| Frontend types manually maintained       | `frontend/src/lib/domain-types.ts`, `lib/types.ts`        | Can drift from backend DTOs                                 |
| No shared type package                   | Backend/frontend boundary                                 | Type duplication                                            |
| Playwright combined-run flake            | Multi-spec runs can hang on server reuse                  | Runner issue, not a source defect                           |