Termp bug fix and updates.

We have a live server in develop environment that needs bug fix and feature updates and Cypress tests passing in new Qase project.
We use github to work on branch PR. and live server will be updated by us daily for live testing and review.

API TypeScript 5.7
Web TypeScript + TSX 5.7
Shared types TypeScript 5.7
PDF converter service Python 3.x (implied by FastAPI/uvicorn)

## CRITICAL — Security & Privacy

| # | Area | Issue | API | UI |
|---|---|---|---|---|
| S1 | Word Count | Naïve whitespace split breaks CJK languages; counts tags and punctuation as words | Yes | Yes |
| S2 | Email | Assignment email links to login page, not the document | Yes | — |
| S3 | Auth | No rate limiting on `/login`, `/register`, `/forgot-password` — brute-force possible | Yes | — |
| S4 | Auth | JWT tokens not invalidated when password is changed — old sessions remain valid | Yes | — |
| S5 | Settings → Security | No Change Password section — neither UI nor API endpoint | Yes | Yes |
| S6 | Settings → Members | Email addresses of all org members visible to translators | Yes | Yes |
| S7 | Analytics | Analytics page accessible to all roles including translators — no restriction | Yes | Yes |
| S8 | Account | No account deletion — GDPR right to erasure not implemented | Yes | Yes |

---

## CRITICAL — Translation Memory Bugs

| # | Area | Issue | API | UI |
|---|---|---|---|---|
| TM1 | TM Cache | Cache key ignores `contextPrev` and `contextNext` — segments in different positions get the same cached result; context match flag is incorrect | Yes | — |
| TM2 | TM Write | Context not saved when writing a confirmed translation back to TM — context matching can never improve organically from translator work | Yes | — |
| TM3 | TM Cache | Cache not invalidated when a TM unit is updated — only new units trigger invalidation; updated translations serve stale matches until TTL expires | Yes | — |

---

## MEDIUM — Translation Memory Gaps

| # | Area | Issue | API | UI |
|---|---|---|---|---|
| TM4 | TM Performance | Full TM loaded from DB for every segment on page load — on a 200-segment document with a large TM this causes severe slowdown on first load | Yes | — |
| TM5 | TM Workflow | Pre-translate only runs at upload time; no way to trigger it after a TM is attached to an existing project with existing documents | Yes | Yes |
| TM6 | TM UI | Concordance results silently truncated to 5 in desktop panel and 10 on mobile — no result count shown and no way to see the rest | — | Yes |

---

## MEDIUM — Core Workflow Gaps

| # | Area | Issue | API | UI |
|---|---|---|---|---|
| W1 | Documents | Sort resets on pagination — sort is applied client-side to the current page only, not server-side across the full dataset | Yes | Yes |
| W2 | Projects | Changing workflow type has no safety check — documents already in review stages become stranded in statuses incompatible with the new workflow | Yes | Yes |
| W3 | Project Settings | Deadline field missing from the project settings edit form — the API already accepts it but the UI never sends it | Yes | Yes |
| W4 | Documents | Stage advance button has no confirmation dialog and no undo — advancing past review is immediate and irreversible | — | Yes |
| W5 | Notifications | No email sent when a workflow stage advances — the next assignee has no way to know work is ready | Yes | — |
| W6 | Segments | `draft` status appears in analytics breakdowns but cannot be set through the UI — creates a ghost bucket with no clear meaning | Yes | Yes |

---

## MEDIUM — Settings & Profile Missing

| # | Area | Issue | API | UI |
|---|---|---|---|---|
| P1 | Settings → General | Org name and slug are read-only — no edit controls and no backend endpoint | Yes | Yes |
| P2 | Settings → Members | Member list shows role badges but has no role-change control — the API endpoint already exists | — | Yes |
| P3 | Settings | No Profile tab — users cannot edit their name or email | Yes | Yes |
| P4 | Settings → Security | No Active Sessions panel — the list and revoke API endpoints are fully implemented but there is zero UI | — | Yes |
| P5 | Settings | No org deletion option for admins | Yes | Yes |
| P6 | Settings → Members | No warning displayed when inviting a user with the Admin role | — | Yes |

---

## MEDIUM — Analytics & Reporting Incomplete

| # | Area | Issue | API | UI |
|---|---|---|---|---|
| A1 | Analytics | QA issue count is hardcoded to zero everywhere — QA panel runs checks but results are never persisted to the database | Yes | Yes |
| A2 | Analytics | Time spent per segment is always null — no `translationStartedAt` timestamp is tracked so duration cannot be calculated | Yes | Yes |
| A3 | Analytics | Average time per segment is always null — blocked by A2 | Yes | Yes |
| A4 | Analytics | Org-level analytics includes archived projects — active project statistics are polluted by completed or closed work | Yes | — |
| A5 | Analytics | Analytics are limited overall — no productivity tracking, no segment status breakdown per user, and no performance insights | Yes | Yes |

---

## MEDIUM — Data Integrity

| # | Area | Issue | API | UI |
|---|---|---|---|---|
| I1 | Projects | Workflow type change does not validate existing segment statuses — documents can be left in states unreachable in the new workflow with no warning | Yes | Yes |
| I2 | Documents | Target word counts are not recalculated when segments are edited — `updateDocumentWordCounts()` exists but is never called from the segment save handler | Yes | — |

---

## LOW — Translator Experience Gaps

| # | Area | Issue | API | UI |
|---|---|---|---|---|
| T1 | TM Panel | TM match percentage badges have no colour coding — industry standard is green for 100%, blue for 95–99%, yellow for 85–94%, orange for 75–84% | — | Yes |
| T2 | TM Panel | No keyboard shortcut to insert TM matches — standard is Ctrl+1 through Ctrl+3 for the top results | — | Yes |
| T3 | Documents | Assignment filter and status filter cannot be combined — no way to filter by both assignment and document status at the same time | Yes | Yes |
| T4 | TM | No language-pair validation when attaching a TM or running matches — a Spanish TM can be attached to an English-to-French project and return suggestions | Yes | — |
| T5 | Concordance | No Ctrl+K keyboard shortcut to open concordance search pre-filled with selected text | — | Yes |

---

## LOW — Document Management Gaps

| # | Area | Issue | API | UI |
|---|---|---|---|---|
| D1 | Upload | No document re-upload or version replacement — deleting and re-uploading loses all translation work already done | Yes | Yes |
| D2 | Upload | Maximum 5 files per batch is hardcoded with no explanation to the user and no bulk upload path for large projects | — | Yes |
| D3 | Upload | `.json`, `.html`, and `.tmx` are missing from the file accept filter and are not handled by the backend parser | Yes | Yes |
| D4 | Documents | No option to download the original uploaded source file — once uploaded it is inaccessible from the UI | Yes | Yes |

---

## LOW — Branding & Organisation

| # | Area | Issue | API | UI |
|---|---|---|---|---|
| B1 | Organisation | No org logo or branding — invitation emails and the UI header use hardcoded product name | Yes | Yes |

---

## Develop Verification (Iterative)

- You submit a PR with your fixes
- We deploy your branch to the develop server
- You run the Cypress suite against the develop URL we provide
- You report results, fix issues, and we repeat until all tests pass on staging

You must be available for multiple iterative testing rounds.

---

## Deliverables

1. GitHub Pull Request with all fixes and implementations.
2. Complete Cypress suite — all new and old suites passing.
3. Manual tests where needed besides automation.
4. Populated Qase.io project — all test cases in plain English, mapped to automation.
5. Screenshots showing Cypress tests running with results visible in the Qase.io dashboard