@terreno/mcp 57.1.0 → 57.3.0

package/src/docs/versioned/next/explanation/roadmap-seed-issues.md

@@ -5,14 +5,19 @@ Ready-to-paste GitHub issue bodies for IPs on the public roadmap — the
 roadmap-tracked work. Open one tracking issue per IP when the IP reaches **Approved**, then
 add it to the **Terreno Roadmap** project with the field values below.
 
+Every entry also gets the `roadmap` label — `bun run roadmap:sync` adds it, so it is not
+repeated on the `**Labels:**` lines. That label is how roadmap items are filtered
+(`gh issue list --label roadmap`, or `label:roadmap` in the GitHub UI); titles carry no
+`[Roadmap]` prefix.
+
 ---
 
 ## oss-governance-baseline
 
-**Title:** `[Roadmap] OSS governance baseline`
+**Title:** `OSS governance baseline`
 
 **Labels:** `area:dx`, `type:chore`  
-**Project fields:** Area=`dx`, Target=`Next`, Impact=`Improvement`, IP=`oss-governance-baseline`, Status=`Shipped`
+**Project fields:** Area=`dx`, Target=`Released`, Impact=`Improvement`, IP=`oss-governance-baseline`, Status=`Shipped`
 
 Establishes the legal and community foundation required before Terreno can launch as a public
 open-source project. It adds a root MIT license, contribution and security policies, a
@@ -29,10 +34,10 @@ contributors or consumers.
 
 ## public-roadmap-github
 
-**Title:** `[Roadmap] Public roadmap on GitHub`
+**Title:** `Public roadmap on GitHub`
 
 **Labels:** `area:dx`, `type:feature`  
-**Project fields:** Area=`dx`, Target=`Next`, Impact=`Improvement`, IP=`public-roadmap-github`, Status=`In progress`
+**Project fields:** Area=`dx`, Target=`Released`, Impact=`Improvement`, IP=`public-roadmap-github`, Status=`Shipped`
 
 Runs Terreno's public roadmap on GitHub while keeping Linear as the internal execution
 tracker. It sets up GitHub Discussions categories, a Terreno Roadmap project board, label
@@ -49,7 +54,7 @@ duplicating sprint planning.
 
 ## deploy-to-gcp
 
-**Title:** `[Roadmap] Deploy to GCP (generalized)`
+**Title:** `Deploy to GCP (generalized)`
 
 **Labels:** `area:deploy`, `type:docs`  
 **Project fields:** Area=`deploy`, Target=`Next`, Impact=`Improvement`, IP=`deploy-to-gcp`, Status=`Planned`
@@ -69,10 +74,10 @@ session-affinity constraints that commonly break production Terreno deployments.
 
 ## agentic-sdlc-plugin
 
-**Title:** `[Roadmap] Agentic SDLC plugin (/terreno-*)`
+**Title:** `Agentic SDLC plugin (/terreno-*)`
 
 **Labels:** `area:dx`, `type:feature`  
-**Project fields:** Area=`dx`, Target=`Next`, Impact=`Feature`, IP=`agentic-sdlc-plugin`, Status=`Planned`
+**Project fields:** Area=`dx`, Target=`Released`, Impact=`Feature`, IP=`agentic-sdlc-plugin`, Status=`Shipped`
 
 Packages and documents Terreno's five-stage `/terreno-*` agentic SDLC pipeline as a portable,
 publicly installable Cursor plugin. The pipeline takes work from a raw request through
@@ -89,10 +94,10 @@ invisible and breaks in consumer apps.
 
 ## rtk-to-syncdb-migration-docs
 
-**Title:** `[Roadmap] RTK deprecation and syncdb migration docs`
+**Title:** `RTK deprecation and syncdb migration docs`
 
 **Labels:** `area:syncdb`, `type:docs`, `deprecation`, `status:blocked`  
-**Project fields:** Area=`syncdb`, Target=`Next`, Impact=`Improvement`, IP=`rtk-to-syncdb-migration-docs`, Status=`Planned`
+**Project fields:** Area=`syncdb`, Target=`Released`, Impact=`Improvement`, IP=`rtk-to-syncdb-migration-docs`, Status=`Shipped`
 
 > Blocked on PR #869. The Project **Status** field has no `Blocked` option, so gating is
 > tracked with the `status:blocked` issue label instead.
@@ -111,10 +116,10 @@ bootstrap output, and upgrade notes. Gates most Wave 1 launch documentation.
 
 ## positioning-django-rails-universal
 
-**Title:** `[Roadmap] Positioning — Django/Rails for TypeScript`
+**Title:** `Positioning — Django/Rails for TypeScript`
 
 **Labels:** `area:docs`, `type:docs`  
-**Project fields:** Area=`docs`, Target=`Next`, Impact=`Improvement`, IP=`positioning-django-rails-universal`, Status=`Planned`
+**Project fields:** Area=`docs`, Target=`Released`, Impact=`Improvement`, IP=`positioning-django-rails-universal`, Status=`Shipped`
 
 Aligns Terreno's messaging across README, docs site, agent context files, and npm package
 metadata under one positioning statement: Django/Rails for TypeScript with universal app
@@ -129,10 +134,10 @@ support, organized around batteries included, universal by default, and AI-nativ
 
 ## docs-reference-coverage
 
-**Title:** `[Roadmap] Reference documentation coverage`
+**Title:** `Reference documentation coverage`
 
 **Labels:** `area:docs`, `type:docs`  
-**Project fields:** Area=`docs`, Target=`Next`, Impact=`Improvement`, IP=`docs-reference-coverage`, Status=`Planned`
+**Project fields:** Area=`docs`, Target=`Next`, Impact=`Improvement`, IP=`docs-reference-coverage`, Status=`In progress`
 
 Gives every published Terreno package a real README and a public docs/reference page instead
 of stubs. Adds missing reference pages, de-stubs package READMEs, sanitizes internal
@@ -147,7 +152,7 @@ leakage, and extends docs-audit CI to catch drift.
 
 ## docs-tutorials-ai-first
 
-**Title:** `[Roadmap] AI-first tutorials`
+**Title:** `AI-first tutorials`
 
 **Labels:** `area:docs`, `type:docs`  
 **Project fields:** Area=`docs`, Target=`Next`, Impact=`Feature`, IP=`docs-tutorials-ai-first`, Status=`Planned`
@@ -165,10 +170,10 @@ features, admin panel, and production deploy — all on syncdb + Better Auth.
 
 ## deployment-foundation
 
-**Title:** `[Roadmap] Deployment foundation`
+**Title:** `Deployment foundation`
 
 **Labels:** `area:deploy`, `type:docs`  
-**Project fields:** Area=`deploy`, Target=`Next`, Impact=`Improvement`, IP=`deployment-foundation`, Status=`Planned`
+**Project fields:** Area=`deploy`, Target=`Released`, Impact=`Improvement`, IP=`deployment-foundation`, Status=`Shipped`
 
 Defines the provider-agnostic deployment baseline every Terreno production app needs: core
 requirements, environment-variable reference, Expo web output modes, and a canonical
@@ -183,14 +188,14 @@ example-backend Dockerfile with CI validation.
 
 ## deploy-to-vercel
 
-**Title:** `[Roadmap] Deploy to Vercel`
+**Title:** `Deploy to Vercel`
 
 **Labels:** `area:deploy`, `type:docs`  
 **Project fields:** Area=`deploy`, Target=`Next`, Impact=`Improvement`, IP=`deploy-to-vercel`, Status=`Planned`
 
 Documents Expo web export on Vercel, preview-deployment CORS and Better Auth origin handling,
-and a deploy-vercel skill with websocket verification. Requires a spike on backend hosting
-options.
+Vercel Functions WebSockets (Public Beta) operator docs, and a deploy-vercel skill with
+websocket verification. Requires a spike on backend hosting options.
 
 - **Implementation plan:** [deploy-to-vercel.md](https://github.com/FlourishHealth/terreno/blob/master/docs/implementationPlans/deploy-to-vercel.md)
 - **Tasks:** [deploy-to-vercel.md](https://github.com/FlourishHealth/terreno/blob/master/docs/tasks/deploy-to-vercel.md)
@@ -201,7 +206,7 @@ options.
 
 ## upgrade-guides-and-skill
 
-**Title:** `[Roadmap] Upgrade guides and upgrading-terreno skill`
+**Title:** `Upgrade guides and upgrading-terreno skill`
 
 **Labels:** `area:mcp`, `type:docs`  
 **Project fields:** Area=`mcp`, Target=`Next`, Impact=`Improvement`, IP=`upgrade-guides-and-skill`, Status=`Planned`
@@ -219,7 +224,7 @@ enforces upgrade-note requirements in release CI.
 
 ## ai-dev-loop-boost
 
-**Title:** `[Roadmap] AI development loop (MCP Boost)`
+**Title:** `AI development loop (MCP Boost)`
 
 **Labels:** `area:mcp`, `type:feature`  
 **Project fields:** Area=`mcp`, Target=`Next`, Impact=`Feature`, IP=`ai-dev-loop-boost`, Status=`Planned`
@@ -237,7 +242,7 @@ observe merged logs and client state, then fix and iterate. Builds on MCP Boost
 
 ## build-terreno-app-validation
 
-**Title:** `[Roadmap] Dogfooding run and launch blog post`
+**Title:** `Dogfooding run and launch blog post`
 
 **Labels:** `area:docs`, `type:chore`  
 **Project fields:** Area=`docs`, Target=`Next`, Impact=`Improvement`, IP=`build-terreno-app-validation`, Status=`Planned`
@@ -254,7 +259,7 @@ using only public docs and skills, then publishes a friction log and blog post.
 
 ## examples-demo-coverage
 
-**Title:** `[Roadmap] Examples, demo, and test coverage`
+**Title:** `Examples, demo, and test coverage`
 
 **Labels:** `area:examples`, `type:chore`  
 **Project fields:** Area=`examples`, Target=`Future`, Impact=`Improvement`, IP=`examples-demo-coverage`, Status=`Planned`
@@ -271,7 +276,7 @@ stories, extends coverage enforcement, and publishes an example-app feature matr
 
 ## web-ssr-and-admin-spa
 
-**Title:** `[Roadmap] Web SSR and admin SPA`
+**Title:** `Web SSR and admin SPA`
 
 **Labels:** `area:ui`, `type:feature`  
 **Project fields:** Area=`ui`, Target=`Future`, Impact=`Feature`, IP=`web-ssr-and-admin-spa`, Status=`Planned`
@@ -291,7 +296,7 @@ ground; SSR is opt-in and depends on Expo SDK 55+.
 
 *Outside the OSS launch program.*
 
-**Title:** `[Roadmap] Infrastructure MCP server (@terreno/infra-mcp)`
+**Title:** `Infrastructure MCP server (@terreno/infra-mcp)`
 
 **Labels:** `area:mcp`, `type:feature`, `status:blocked`  
 **Project fields:** Area=`mcp`, Target=`Future`, Impact=`Feature`, IP=`infra-mcp`, Status=`Planned`
@@ -323,10 +328,10 @@ issue with `Status=Planned` and fill the IP field when the IP lands.
 
 ## comms-abstraction
 
-**Title:** `[Roadmap] Pluggable communications layer (@terreno/comms)`
+**Title:** `Pluggable communications layer (@terreno/comms)`
 
 **Labels:** `area:api`, `type:feature`
-**Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=`comms-abstraction`, Status=`Planned`
+**Project fields:** Area=`api`, Target=`Released`, Impact=`Feature`, IP=`comms-abstraction`, Status=`Shipped`
 
 Terreno backends have no way to send email, SMS, or push notifications today. This adds a
 new `@terreno/comms` package with provider interfaces for mail, SMS, push, and OTP
@@ -344,10 +349,10 @@ roadmap item, so apps only install the SDKs they use.
 
 ## comms-adapter-expo-push
 
-**Title:** `[Roadmap] Comms adapter — Expo push notifications`
+**Title:** `Comms adapter — Expo push notifications`
 
 **Labels:** `area:api`, `type:feature`
-**Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=`comms-adapter-expo-push`, Status=`Planned`
+**Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=`comms-adapter-expo-push`, Status=`In progress`
 
 Implements the `@terreno/comms` push provider on Expo's push service using
 `expo-server-sdk` (already a dependency of `@terreno/api`, currently unused). Covers token
@@ -363,7 +368,7 @@ half — `getExpoPushTokenAsync` registration — already exists in example-fron
 
 ## comms-adapter-twilio-sms
 
-**Title:** `[Roadmap] Comms adapter — Twilio SMS`
+**Title:** `Comms adapter — Twilio SMS`
 
 **Labels:** `area:api`, `type:feature`
 **Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=`comms-adapter-twilio-sms`, Status=`Planned`
@@ -382,10 +387,10 @@ catalog.
 
 ## comms-adapter-twilio-verify
 
-**Title:** `[Roadmap] Comms adapter — Twilio Verify (OTP)`
+**Title:** `Comms adapter — Twilio Verify (OTP)`
 
 **Labels:** `area:api`, `type:feature`
-**Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=`comms-adapter-twilio-verify`, Status=`Planned`
+**Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=`comms-adapter-twilio-verify`, Status=`Shipped`
 
 Implements the `@terreno/comms` verification provider on Twilio Verify for SMS and email
 one-time codes. This is the delivery channel for phone verification and for the future MFA
@@ -400,10 +405,10 @@ step-up work, without Terreno storing or rate-limiting codes itself.
 
 ## comms-adapter-sendgrid
 
-**Title:** `[Roadmap] Comms adapter — transactional email (SendGrid)`
+**Title:** `Comms adapter — transactional email (SendGrid)`
 
 **Labels:** `area:api`, `type:feature`
-**Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=`comms-adapter-sendgrid`, Status=`Planned`
+**Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=`comms-adapter-sendgrid`, Status=`In progress`
 
 Implements the first `@terreno/comms` mail provider on Twilio SendGrid so Terreno apps can
 send transactional email (password resets, invitations, verification), sharing the Twilio
@@ -419,7 +424,7 @@ SES, SMTP) get their own items when demand appears.
 
 ## comms-admin-dashboard
 
-**Title:** `[Roadmap] Comms admin dashboard (errors, retries, log digging)`
+**Title:** `Comms admin dashboard (errors, retries, log digging)`
 
 **Labels:** `area:admin`, `type:feature`
 **Project fields:** Area=`admin`, Target=`Next`, Impact=`Feature`, IP=`comms-admin-dashboard`, Status=`Planned`
@@ -440,7 +445,7 @@ comms abstraction.
 
 ## password-reset-and-email-verification
 
-**Title:** `[Roadmap] Password reset and email verification`
+**Title:** `Password reset and email verification`
 
 **Labels:** `area:auth`, `type:feature`
 **Project fields:** Area=`auth`, Target=`Next`, Impact=`Feature`, IP=`password-reset-and-email-verification`, Status=`Planned`
@@ -459,18 +464,21 @@ equivalents, and sends the emails through `@terreno/comms`.
 
 ## inbound-webhooks
 
-**Title:** `[Roadmap] Inbound webhook framework`
+**Title:** `Inbound webhook framework`
 
 **Labels:** `area:api`, `type:feature`
-**Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
+**Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=`inbound-webhooks`, Status=`Planned`
+
+**GitHub:** https://github.com/FlourishHealth/terreno/issues/1172
 
 Terreno has outbound notifiers (Slack, Google Chat, Zoom) but no framework for receiving
 webhooks from external services. Adds a plugin for registering webhook endpoints with
 signature verification, raw-body handling, idempotency/replay protection, and event
-dispatch — required by Stripe billing and by Twilio/Expo delivery status callbacks.
+dispatch — required by Stripe billing and by Twilio/SendGrid delivery status callbacks
+(Expo push polls receipts and does not use this plugin).
 
-- **Implementation plan:** *(not yet written)*
-- **Tasks:** *(not yet written)*
+- **Implementation plan:** [inbound-webhooks.md](https://github.com/FlourishHealth/terreno/blob/master/docs/implementationPlans/inbound-webhooks.md)
+- **Tasks:** [inbound-webhooks.md](https://github.com/FlourishHealth/terreno/blob/master/docs/tasks/inbound-webhooks.md)
 - **RTK flag:** None
 - **Depends on:** —
 
@@ -478,19 +486,17 @@ dispatch — required by Stripe billing and by Twilio/Expo delivery status callb
 
 ## orgs-and-teams
 
-**Title:** `[Roadmap] Organizations, teams, and multi-tenant scoping`
+**Title:** `Organizations, teams, and multi-tenant scoping`
 
 **Labels:** `area:api`, `type:feature`
-**Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=`orgs-and-teams`, Status=`Planned`
+**Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=`orgs-and-teams`, Status=`Declined`
 
-Terreno's data model is per-user: `ownerId`, `OwnerQueryFilter`, and owner permissions.
-B2B apps need organizations. This adds Organization and Membership models, an org-context
-middleware, an `OrgQueryFilter` and org-scoping schema plugin for modelRouter, and
-membership-aware permission classes — the tenant analog of the existing owner stack.
-Invitations and the management UI are separate items.
+Superseded by `org-management-ui` (native orgs + RBAC + admin UI). Do not open new work
+from this item.
 
-- **Implementation plan:** [orgs-and-teams.md](https://github.com/FlourishHealth/terreno/blob/master/docs/implementationPlans/orgs-and-teams.md)
-- **Tasks:** [orgs-and-teams.md](https://github.com/FlourishHealth/terreno/blob/master/docs/tasks/orgs-and-teams.md)
+- **Implementation plan:** [orgs-and-teams.md](https://github.com/FlourishHealth/terreno/blob/master/docs/implementationPlans/orgs-and-teams.md) (superseded)
+- **Canonical IP:** [org-management-ui.md](https://github.com/FlourishHealth/terreno/blob/master/docs/implementationPlans/org-management-ui.md)
+- **Tasks:** [org-management-ui.md](https://github.com/FlourishHealth/terreno/blob/master/docs/tasks/org-management-ui.md)
 - **RTK flag:** None
 - **Depends on:** —
 
@@ -498,16 +504,16 @@ Invitations and the management UI are separate items.
 
 ## rbac-permissions
 
-**Title:** `[Roadmap] Role-based access control`
+**Title:** `Role-based access control`
 
 **Labels:** `area:api`, `type:feature`
-**Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=`rbac-permissions`, Status=`Planned`
+**Project fields:** Area=`api`, Target=`Released`, Impact=`Feature`, IP=`rbac-permissions`, Status=`Shipped`
 
 Replaces the binary `admin` flag + owner checks with a first-class RBAC module: a typed
 permission vocabulary on Better Auth's access-control engine, DB-backed roles editable in
 the admin panel, document-level scopes, field-level views, and one `can()` check enforced
 across REST, websockets, MCP tools, and admin. An API design draft already exists;
-`orgs-and-teams` extends it with org-scoped grants.
+`org-management-ui` extends it with org-scoped membership grants (`org-admin` / `member`).
 
 - **Implementation plan:** [rbac-permissions.md](https://github.com/FlourishHealth/terreno/blob/master/docs/implementationPlans/rbac-permissions.md)
 - **Tasks:** *(TBD — design doc predates task split)*
@@ -518,7 +524,7 @@ across REST, websockets, MCP tools, and admin. An API design draft already exist
 
 ## invitations-and-seats
 
-**Title:** `[Roadmap] Invitations and seat management`
+**Title:** `Invitations and seat management`
 
 **Labels:** `area:api`, `type:feature`
 **Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -530,31 +536,31 @@ billing can later enforce. Emails go through `@terreno/comms`.
 - **Implementation plan:** *(not yet written)*
 - **Tasks:** *(not yet written)*
 - **RTK flag:** None
-- **Depends on:** orgs-and-teams, comms-abstraction, comms-adapter-sendgrid
+- **Depends on:** org-management-ui, comms-abstraction, comms-adapter-sendgrid
 
 ---
 
 ## org-management-ui
 
-**Title:** `[Roadmap] Org switcher and member management screens`
+**Title:** `Organizations as a first-class primitive (admin UI + RBAC)`
 
-**Labels:** `area:ui`, `type:feature`
-**Project fields:** Area=`ui`, Target=`Next`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
+**Labels:** `area:api`, `type:feature`
+**Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=`org-management-ui`, Status=`Planned`
 
-The frontend counterpart of the tenancy track: an organization switcher, members list with
-roles, invite flow, and org settings screens in `@terreno/ui` + example-frontend, working
-on web and native.
+Native Organization and Membership models, RBAC (`org-admin`, `operator`, `superadmin`),
+and admin-panel directory / switcher / members / settings. Operators manage all orgs;
+org-admins manage only the current org. Invites and billing are design-only placeholders.
 
-- **Implementation plan:** *(not yet written)*
-- **Tasks:** *(not yet written)*
-- **RTK flag:** Partial — screens should target the syncdb data layer where available
-- **Depends on:** orgs-and-teams, rbac-permissions, invitations-and-seats
+- **Implementation plan:** [org-management-ui.md](https://github.com/FlourishHealth/terreno/blob/master/docs/implementationPlans/org-management-ui.md)
+- **Tasks:** [org-management-ui.md](https://github.com/FlourishHealth/terreno/blob/master/docs/tasks/org-management-ui.md)
+- **RTK flag:** Partial — admin screens use generated SDK / `useAdminApi`
+- **Depends on:** rbac-permissions
 
 ---
 
 ## billing-stripe
 
-**Title:** `[Roadmap] Stripe billing and subscriptions`
+**Title:** `Stripe billing and subscriptions`
 
 **Labels:** `area:api`, `type:feature`
 **Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=`billing-stripe`, Status=`Planned`
@@ -568,13 +574,13 @@ are a separate item.
 - **Implementation plan:** [billing-stripe.md](https://github.com/FlourishHealth/terreno/blob/master/docs/implementationPlans/billing-stripe.md)
 - **Tasks:** [billing-stripe.md](https://github.com/FlourishHealth/terreno/blob/master/docs/tasks/billing-stripe.md)
 - **RTK flag:** None
-- **Depends on:** orgs-and-teams, inbound-webhooks
+- **Depends on:** org-management-ui, inbound-webhooks
 
 ---
 
 ## native-module-baseline
 
-**Title:** `[Roadmap] Native module baseline for the next major release`
+**Title:** `Native module baseline for the next major release`
 
 **Labels:** `area:ui`, `type:chore`, `breaking`
 **Project fields:** Area=`ui`, Target=`Next`, Impact=`Breaking`, IP=*(not yet written)*, Status=`Planned`
@@ -596,7 +602,7 @@ same binary. Manifest finalized 2026-08-09 (decisions D1/D3/D7); TenTap excluded
 
 ## create-terreno-app
 
-**Title:** `[Roadmap] create-terreno-app scaffolding CLI`
+**Title:** `create-terreno-app scaffolding CLI`
 
 **Labels:** `area:dx`, `type:feature`
 **Project fields:** Area=`dx`, Target=`Next`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -615,7 +621,7 @@ delegating to it.
 
 ## charts-and-dashboards
 
-**Title:** `[Roadmap] Charts and dashboard primitives`
+**Title:** `Charts and dashboard primitives`
 
 **Labels:** `area:ui`, `type:feature`
 **Project fields:** Area=`ui`, Target=`Next`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -634,7 +640,7 @@ layout, with demo stories and docs.
 
 ## dark-mode-theme
 
-**Title:** `[Roadmap] First-class dark mode`
+**Title:** `First-class dark mode`
 
 **Labels:** `area:ui`, `type:feature`
 **Project fields:** Area=`ui`, Target=`Next`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -653,7 +659,7 @@ root views and system chrome follow the scheme.
 
 ## data-grid-server-filters
 
-**Title:** `[Roadmap] DataTable server-side filtering and search`
+**Title:** `DataTable server-side filtering and search`
 
 **Labels:** `area:ui`, `type:feature`
 **Project fields:** Area=`ui`, Target=`Next`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -671,7 +677,7 @@ list screens get server-side filtering without custom plumbing. Admin tables ado
 
 ## mobile-iap-revenuecat
 
-**Title:** `[Roadmap] Mobile in-app purchases (RevenueCat)`
+**Title:** `Mobile in-app purchases (RevenueCat)`
 
 **Labels:** `area:api`, `type:feature`
 **Project fields:** Area=`api`, Target=`Future`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -690,7 +696,7 @@ native module baseline regardless, so this lands as a JS/OTA feature when schedu
 
 ## notification-center
 
-**Title:** `[Roadmap] In-app notification center`
+**Title:** `In-app notification center`
 
 **Labels:** `area:ui`, `type:feature`
 **Project fields:** Area=`ui`, Target=`Next`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -708,7 +714,7 @@ the in-app channel beside `@terreno/comms` mail/SMS/push.
 
 ## command-palette
 
-**Title:** `[Roadmap] Command palette (⌘K)`
+**Title:** `Command palette (⌘K)`
 
 **Labels:** `area:ui`, `type:feature`
 **Project fields:** Area=`ui`, Target=`Future`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -725,7 +731,7 @@ actions, navigation targets, and async search sources. Admin panel adopts it fir
 
 ## wizard-stepper
 
-**Title:** `[Roadmap] Generic multi-step wizard component`
+**Title:** `Generic multi-step wizard component`
 
 **Labels:** `area:ui`, `type:feature`
 **Project fields:** Area=`ui`, Target=`Future`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -743,7 +749,7 @@ wizard/stepper: step state, validation gates, progress indicator, and per-step p
 
 ## wysiwyg-editor
 
-**Title:** `[Roadmap] Rich text (WYSIWYG) editor`
+**Title:** `Rich text (WYSIWYG) editor`
 
 **Labels:** `area:ui`, `type:feature`
 **Project fields:** Area=`ui`, Target=`Future`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -762,7 +768,7 @@ native module baseline, adopting it means waiting for a later major release.
 
 ## global-search
 
-**Title:** `[Roadmap] Global search across entities`
+**Title:** `Global search across entities`
 
 **Labels:** `area:api`, `type:feature`
 **Project fields:** Area=`api`, Target=`Future`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -780,7 +786,7 @@ and a search UI hook — feeding the command palette and app-level search bars.
 
 ## enterprise-sso
 
-**Title:** `[Roadmap] Enterprise SSO (SAML / OIDC)`
+**Title:** `Enterprise SSO (SAML / OIDC)`
 
 **Labels:** `area:auth`, `type:feature`
 **Project fields:** Area=`auth`, Target=`Future`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -793,13 +799,13 @@ baseline.
 - **Implementation plan:** *(not yet written)*
 - **Tasks:** *(not yet written)*
 - **RTK flag:** None
-- **Depends on:** orgs-and-teams, native-module-baseline
+- **Depends on:** org-management-ui, native-module-baseline
 
 ---
 
 ## mfa-step-up-auth
 
-**Title:** `[Roadmap] MFA and biometric step-up auth`
+**Title:** `MFA and biometric step-up auth`
 
 **Labels:** `area:auth`, `type:feature`
 **Project fields:** Area=`auth`, Target=`Future`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -817,7 +823,7 @@ enforcement hooks in the permission layer.
 
 ## framework-audit-log
 
-**Title:** `[Roadmap] Framework-level audit log`
+**Title:** `Framework-level audit log`
 
 **Labels:** `area:api`, `type:feature`
 **Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -830,23 +836,26 @@ B2B customers.
 - **Implementation plan:** *(not yet written)*
 - **Tasks:** *(not yet written)*
 - **RTK flag:** None
-- **Depends on:** orgs-and-teams
+- **Depends on:** org-management-ui
 
 ---
 
 ## rate-limiting
 
-**Title:** `[Roadmap] API rate limiting`
+**Title:** `API rate limiting`
 
 **Labels:** `area:api`, `type:feature`
-**Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
+**Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=`rate-limiting`, Status=`Planned`
 
-Adds HTTP rate limiting to `@terreno/api`: per-user/per-org/per-IP policies, sensible
-defaults for auth and OTP endpoints, memory and Redis stores, and standard rate-limit
-headers. Today only realtime subscriptions are capped.
+Adds opt-in HTTP rate limiting to `@terreno/api`: per-user or per-IP keys, stricter
+auth/OTP buckets (including login), memory Redis or Mongo stores, and 429 rate-limit
+headers. Default is off until Terreno 58. Sync mutation nacks stay a separate limiter.
 
-- **Implementation plan:** *(not yet written)*
-- **Tasks:** *(not yet written)*
+Shipping this work **closes** https://github.com/FlourishHealth/terreno/issues/1187.
+
+- **Implementation plan:** [rate-limiting.md](https://github.com/FlourishHealth/terreno/blob/master/docs/implementationPlans/rate-limiting.md)
+- **Tasks:** [rate-limiting.md](https://github.com/FlourishHealth/terreno/blob/master/docs/tasks/rate-limiting.md)
+- **How-to:** [rate-limiting.md](../how-to/rate-limiting.md)
 - **RTK flag:** None
 - **Depends on:** —
 
@@ -854,7 +863,7 @@ headers. Today only realtime subscriptions are capped.
 
 ## job-queues
 
-**Title:** `[Roadmap] Durable background jobs`
+**Title:** `Durable background jobs`
 
 **Labels:** `area:api`, `type:feature`
 **Project fields:** Area=`api`, Target=`Next`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -872,7 +881,7 @@ a Redis/BullMQ driver — so email sends, webhook retries, and billing sync surv
 
 ## mongo-migrations
 
-**Title:** `[Roadmap] MongoDB migrations tooling`
+**Title:** `MongoDB migrations tooling`
 
 **Labels:** `area:api`, `type:feature`
 **Project fields:** Area=`api`, Target=`Future`, Impact=`Feature`, IP=*(not yet written)*, Status=`Planned`
@@ -888,38 +897,152 @@ ad-hoc backfill scripts.
 
 ---
 
+# API architecture
+
+Internal seams in `@terreno/api` that several roadmap items depend on. They ship no new
+product surface on their own; they remove the duplicated write, permission, registry, and
+schema-walking paths that every later API feature would otherwise have to fork.
+
+## unified-mutation-executors
+
+**Title:** `[Roadmap] Unified mutation executors (MCP to executors)`
+
+**Labels:** `area:api`, `type:chore`
+**Project fields:** Area=`api`, Target=`Released`, Impact=`Improvement`, IP=`unified-mutation-executors`, Status=`Shipped`
+
+Gives create, update, and delete a single write pipeline. REST and Sync already call
+`executeCreate` / `executeUpdate` / `executeDelete`; MCP's write handlers still run their own
+permissions, transformers, hooks, and saves. Pointing MCP at the shared executors means a
+permission, hook, field-view, or soft-delete fix lands once instead of twice.
+
+- **Implementation plan:** [unified-mutation-executors.md](https://github.com/FlourishHealth/terreno/blob/master/docs/implementationPlans/unified-mutation-executors.md)
+- **Tasks:** [unified-mutation-executors.md](https://github.com/FlourishHealth/terreno/blob/master/docs/tasks/unified-mutation-executors.md)
+- **RTK flag:** None
+- **Depends on:** —
+
+---
+
+## collection-registry
+
+**Title:** `[Roadmap] One collection registry`
+
+**Labels:** `area:api`, `type:chore`
+**Project fields:** Area=`api`, Target=`Next`, Impact=`Improvement`, IP=`collection-registry`, Status=`Planned`
+
+Registers a `modelRouter` collection once. MCP, realtime, and Sync each keep a process-global
+array plus an `update*RegistryOptions` call today, so every RBAC or MCP change has to touch
+three registries. A single `CollectionRegistry` keyed by route path holds `{path, model,
+options, surfaces}` and the existing per-surface lookups become views over it.
+
+- **Implementation plan:** [collection-registry.md](https://github.com/FlourishHealth/terreno/blob/master/docs/implementationPlans/collection-registry.md)
+- **Tasks:** [collection-registry.md](https://github.com/FlourishHealth/terreno/blob/master/docs/tasks/collection-registry.md)
+- **RTK flag:** None
+- **Depends on:** unified-mutation-executors
+
+---
+
+## can-as-permission-seam
+
+**Title:** `[Roadmap] can() as the permission seam`
+
+**Labels:** `area:api`, `type:chore`
+**Project fields:** Area=`api`, Target=`Next`, Impact=`Improvement`, IP=`can-as-permission-seam`, Status=`Planned`
+
+Finishes the RBAC work by making `accessControl.can()` the enforcement engine wherever a
+router declares `access`. Today RBAC roles and statements are compiled down into legacy
+`PermissionMethod[]` arrays and `checkPermissions` remains the real decision point, so apps
+must pass both `access` and `permissions` and the two can disagree.
+
+- **Implementation plan:** [can-as-permission-seam.md](https://github.com/FlourishHealth/terreno/blob/master/docs/implementationPlans/can-as-permission-seam.md)
+- **Tasks:** [can-as-permission-seam.md](https://github.com/FlourishHealth/terreno/blob/master/docs/tasks/can-as-permission-seam.md)
+- **RTK flag:** None
+- **Depends on:** unified-mutation-executors, rbac-permissions
+
+---
+
+## describe-model-schema
+
+**Title:** `[Roadmap] describeModel() schema metadata`
+
+**Labels:** `area:api`, `type:chore`
+**Project fields:** Area=`api`, Target=`Next`, Impact=`Improvement`, IP=`describe-model-schema`, Status=`Planned`
+
+Walks each Mongoose schema once into a shared `ModelDescription`. OpenAPI generation, the
+admin field-widget extractor, and the MCP Zod tool generator each re-interpret `schema.paths`
+their own way today, so a field type that renders correctly in admin can still be wrong in
+MCP or the OpenAPI spec.
+
+- **Implementation plan:** [describe-model-schema.md](https://github.com/FlourishHealth/terreno/blob/master/docs/implementationPlans/describe-model-schema.md)
+- **Tasks:** [describe-model-schema.md](https://github.com/FlourishHealth/terreno/blob/master/docs/tasks/describe-model-schema.md)
+- **RTK flag:** None
+- **Depends on:** —
+
+---
+
+## pluggable-database-sqlite
+
+**Title:** `[Roadmap] Pluggable database layer and SQLite adapter`
+
+**Labels:** `area:api`, `type:feature`
+**Project fields:** Area=`api`, Target=`Future`, Impact=`Feature`, IP=`pluggable-database-sqlite`, Status=`Planned`
+
+Extracts a `DatabaseAdapter` seam under `modelRouter`, keeps Mongoose/MongoDB as the default
+adapter behind it with no behavior change, and ships a SQLite adapter (`@terreno/db-sqlite`)
+covering CRUD, permissions, population, OpenAPI, and admin. Apps keep authoring models as
+Mongoose schemas on either database; Mongo-only capabilities (change streams, Atlas search)
+stay gated behind capability flags.
+
+- **Implementation plan:** [pluggable-database-sqlite.md](https://github.com/FlourishHealth/terreno/blob/master/docs/implementationPlans/pluggable-database-sqlite.md)
+- **Tasks:** [pluggable-database-sqlite.md](https://github.com/FlourishHealth/terreno/blob/master/docs/tasks/pluggable-database-sqlite.md)
+- **RTK flag:** None
+- **Depends on:** describe-model-schema
+
+---
+
 # Shipped, umbrella, and declined IPs
 
 Tracking issues created for IPs that previously lacked a `**Roadmap issue:**` header.
-Add each to the **Terreno Roadmap** project with the `IP` field set to the slug below.
-
-| IP slug | GitHub issue | Status |
-|---------|--------------|--------|
-| `admin-only` | https://github.com/FlourishHealth/terreno/issues/1075 | Shipped |
-| `admin-ui-v2-django-parity` | https://github.com/FlourishHealth/terreno/issues/1076 | Shipped |
-| `admin-script-runner` | https://github.com/FlourishHealth/terreno/issues/1077 | Shipped |
-| `consent-forms` | https://github.com/FlourishHealth/terreno/issues/1078 | Shipped |
-| `upgrade-banner` | https://github.com/FlourishHealth/terreno/issues/1079 | Shipped |
-| `apierror-standard-error-redesign` | https://github.com/FlourishHealth/terreno/issues/1080 | Shipped |
-| `syncdb-local-first` | https://github.com/FlourishHealth/terreno/issues/1081 | Shipped |
-| `feature-flags-openfeature` | https://github.com/FlourishHealth/terreno/issues/1082 | Shipped |
-| `design-blend-skill` | https://github.com/FlourishHealth/terreno/issues/1083 | Shipped |
-| `ModularAPI` | https://github.com/FlourishHealth/terreno/issues/1084 | Shipped |
-| `mcp-boost-parity` | https://github.com/FlourishHealth/terreno/issues/1085 | In progress |
-| `docs-site-and-versioning` | https://github.com/FlourishHealth/terreno/issues/1086 | Planned |
-| `syncdb-codegen` | https://github.com/FlourishHealth/terreno/issues/1087 | Planned |
-| `migrate-cicd-to-circleci` | https://github.com/FlourishHealth/terreno/issues/1088 | Planned |
-| `rbac-permissions` | https://github.com/FlourishHealth/terreno/issues/1089 | Planned |
-| `infra-mcp` | https://github.com/FlourishHealth/terreno/issues/1090 | Planned (blocked) |
-| `comms-admin-dashboard` | https://github.com/FlourishHealth/terreno/issues/1091 | Planned |
-| `model-router-mcp` | https://github.com/FlourishHealth/terreno/issues/1092 | Planned |
-| `terreno-langfuse-integration` | https://github.com/FlourishHealth/terreno/issues/1093 | Future |
-| `oss-launch-program` | https://github.com/FlourishHealth/terreno/issues/1094 | In progress |
-| `b2b-platform-program` | https://github.com/FlourishHealth/terreno/issues/1095 | Planned |
-| `offline-mode` | https://github.com/FlourishHealth/terreno/issues/1096 | Declined |
-| `model-router-actions` | https://github.com/FlourishHealth/terreno/issues/1097 | Declined |
-| `feature-flags` | https://github.com/FlourishHealth/terreno/issues/1098 | Declined |
-| `admin-improvements` | https://github.com/FlourishHealth/terreno/issues/1099 | Declined |
+`bun run roadmap:sync` reads this table directly — every column is a board field
+value, so a row here is the whole record for that item. Values must come from
+[`.github/roadmap-fields.yml`](https://github.com/FlourishHealth/terreno/blob/master/.github/roadmap-fields.yml)
+(`Status`, `Target`, `Impact`) and from the `area:*` labels in
+[`.github/labels.yml`](https://github.com/FlourishHealth/terreno/blob/master/.github/labels.yml)
+(`Area`). Already-shipped work uses `Target = Released`.
+
+When a slug also has a `##` section above, the section supplies the field values and
+this table supplies only the issue number.
+
+| IP slug | GitHub issue | Status | Area | Target | Impact | Type |
+|---------|--------------|--------|------|--------|--------|------|
+| `admin-only` | https://github.com/FlourishHealth/terreno/issues/1075 | `Shipped` | `admin` | `Released` | `Feature` | `type:feature` |
+| `admin-ui-v2-django-parity` | https://github.com/FlourishHealth/terreno/issues/1076 | `Shipped` | `admin` | `Released` | `Feature` | `type:feature` |
+| `admin-script-runner` | https://github.com/FlourishHealth/terreno/issues/1077 | `Shipped` | `admin` | `Released` | `Feature` | `type:feature` |
+| `consent-forms` | https://github.com/FlourishHealth/terreno/issues/1078 | `Shipped` | `ui` | `Released` | `Feature` | `type:feature` |
+| `upgrade-banner` | https://github.com/FlourishHealth/terreno/issues/1079 | `Shipped` | `ui` | `Released` | `Feature` | `type:feature` |
+| `apierror-standard-error-redesign` | https://github.com/FlourishHealth/terreno/issues/1080 | `Shipped` | `api` | `Released` | `Breaking` | `type:feature` |
+| `syncdb-local-first` | https://github.com/FlourishHealth/terreno/issues/1081 | `Shipped` | `syncdb` | `Released` | `Feature` | `type:feature` |
+| `feature-flags-openfeature` | https://github.com/FlourishHealth/terreno/issues/1082 | `Shipped` | `api` | `Released` | `Feature` | `type:feature` |
+| `design-blend-skill` | https://github.com/FlourishHealth/terreno/issues/1083 | `Shipped` | `dx` | `Released` | `Feature` | `type:feature` |
+| `ModularAPI` | https://github.com/FlourishHealth/terreno/issues/1084 | `Shipped` | `api` | `Released` | `Feature` | `type:feature` |
+| `mcp-boost-parity` | https://github.com/FlourishHealth/terreno/issues/1085 | `In progress` | `mcp` | `Next` | `Feature` | `type:feature` |
+| `docs-site-and-versioning` | https://github.com/FlourishHealth/terreno/issues/1086 | `Planned` | `docs` | `Next` | `Feature` | `type:docs` |
+| `syncdb-codegen` | https://github.com/FlourishHealth/terreno/issues/1110 | `Shipped` | `syncdb` | `Released` | `Feature` | `type:feature` |
+| `migrate-cicd-to-circleci` | https://github.com/FlourishHealth/terreno/issues/1088 | `In progress` | `dx` | `Next` | `Improvement` | `type:chore` |
+| `rbac-permissions` | https://github.com/FlourishHealth/terreno/issues/1089 | `Shipped` | `api` | `Released` | `Feature` | `type:feature` |
+| `infra-mcp` | https://github.com/FlourishHealth/terreno/issues/1090 | `Planned` | `mcp` | `Future` | `Feature` | `type:feature` |
+| `comms-admin-dashboard` | https://github.com/FlourishHealth/terreno/issues/1091 | `Planned` | `admin` | `Next` | `Feature` | `type:feature` |
+| `model-router-mcp` | https://github.com/FlourishHealth/terreno/issues/1092 | `Shipped` | `mcp` | `Released` | `Feature` | `type:feature` |
+| `terreno-langfuse-integration` | https://github.com/FlourishHealth/terreno/issues/1093 | `Planned` | `ai` | `Future` | `Feature` | `type:feature` |
+| `oss-launch-program` | https://github.com/FlourishHealth/terreno/issues/1094 | `In progress` | `dx` | `Next` | `Improvement` | `type:chore` |
+| `b2b-platform-program` | https://github.com/FlourishHealth/terreno/issues/1095 | `Planned` | `api` | `Next` | `Feature` | `type:feature` |
+| `offline-mode` | https://github.com/FlourishHealth/terreno/issues/1096 | `Declined` | `syncdb` | `Future` | `Feature` | `type:feature` |
+| `model-router-actions` | https://github.com/FlourishHealth/terreno/issues/1097 | `Declined` | `api` | `Future` | `Feature` | `type:feature` |
+| `feature-flags` | https://github.com/FlourishHealth/terreno/issues/1098 | `Declined` | `api` | `Future` | `Feature` | `type:feature` |
+| `admin-improvements` | https://github.com/FlourishHealth/terreno/issues/1099 | `Declined` | `admin` | `Future` | `Improvement` | `type:feature` |
+
+**Duplicate to retire:** [#1087](https://github.com/FlourishHealth/terreno/issues/1087)
+covers the same `syncdb-codegen` IP as [#1110](https://github.com/FlourishHealth/terreno/issues/1110).
+#1110 carries the fuller description and is the one on the board; close #1087 as a duplicate.
 
 Research and design sub-documents share the parent IP's issue: `admin-only-research` →
 #1075; `infra-mcp-research` → #1090; `migrate-cicd-to-circleci-research` → #1088;