@terreno/mcp 57.18.0 → 57.19.2

package/dist/docs/versioned/57.18.0/tasks/mongodb-migrations-tooling.md

@@ -0,0 +1,107 @@
+# Tasks: MongoDB migrations tooling
+
+IP: [mongodb-migrations-tooling.md](../implementationPlans/mongodb-migrations-tooling.md)  
+**Closes:** https://github.com/TerrenoLabs/terreno/issues/1189
+
+**Feature profile:** false (full IP)
+
+## Phase 1 — Runner, lock, history
+
+- [x] **Task 1.1**: Migration context + in-memory/programmatic runner
+  - Delivers: `runMigrations({migrations, dryRun})` runs pending `up` in order; dry-run calls `up({dryRun: true})` and does **not** record applied ids; wet records checksum + `appliedAt`; already-applied ids are skipped; checksum mismatch throws
+  - Files: `api/src/migrations/types.ts`, `api/src/migrations/runner.ts`, `api/src/migrations/runner.test.ts`
+  - Blocked by: none
+  - Skills: `terreno-backend-api`, `backend-test-env`, `mongoose-schema-safety`
+  - Docs: stub “Migrations” subsection in `docs/reference/api.md`
+  - Acceptance: bun tests — dry-run increments a counter inside `up` but history stays empty; wet applies once; second wet is a no-op; edited checksum fails
+
+- [x] **Task 1.2**: Lock collection (wait, heartbeat, 10-minute steal)
+  - Delivers: `withMigrationLock` uses `terreno_migrations` `_id: "_lock"`; concurrent second waiter proceeds after steal when `expiresAt` is past; holder heartbeats; `finally` releases
+  - Files: `api/src/migrations/lock.ts`, `api/src/migrations/lock.test.ts`; wire lock around wet `runMigrations`
+  - Blocked by: 1.1
+  - Skills: `backend-test-env`, `mongoose-schema-safety`
+  - Docs: lock TTL in the api.md stub
+  - Acceptance: two overlapping wet runs serialize; expired lock is stolen; crash-simulated missing release still steals after TTL (test injects past `expiresAt`)
+
+## Phase 2 — Files, CLI, production gate
+
+- [x] **Task 2.1**: File loader + `checkMigrationFiles`
+  - Delivers: load `migrations/<YYYYMMDDHHmmss>-<slug>.ts`; id must match filename; duplicate ids fail; optional `down`; `checkMigrationFiles` is the no-Mongo CI check
+  - Files: `api/src/migrations/load.ts`, `api/src/migrations/load.test.ts`, fixture files under `api/src/migrations/fixtures/`
+  - Blocked by: 1.1
+  - Skills: `terreno-backend-api`
+  - Docs: file naming in api.md
+  - Acceptance: tests for sort order, bad id, missing export, successful load of `up`/`down`
+
+- [x] **Task 2.2**: Production gate + CLI `status`/`up`/`down`/`check`
+  - Delivers: `terreno-migrate` bin; prod wet requires `ALLOW_MIGRATIONS=true` and `--force`; `down --steps` stops with a clear error when `down` is missing; `--dry` never writes history
+  - Files: `api/src/migrations/cli.ts`, `api/src/migrations/cli.test.ts`, `api/package.json` `bin`, `api/src/index.ts` exports
+  - Blocked by: 1.2, 2.1
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: command table in `docs/how-to/run-mongodb-migrations.md` (create page); `ALLOW_MIGRATIONS` row in `docs/reference/environment-variables.md`
+  - Acceptance: argv tests (help, check, dry up, prod deny); integration up/down against memory Mongo; `down` without function fails
+
+## Phase 3 — Generate from schema snapshot
+
+- [x] **Task 3.1**: Schema catalog + diff
+  - Delivers: `buildSchemaCatalog(models)` and `diffSchemaCatalog(before, after)` covering indexes, optional fields, required, unique, rename heuristic
+  - Files: `api/src/migrations/schemaCatalog.ts`, `api/src/migrations/schemaCatalog.test.ts`
+  - Blocked by: none (can parallel 1.x in theory; Pick runs after 2.2)
+  - Skills: `mongoose-schema-safety`
+  - Docs: what generate can/cannot emit (how-to)
+  - Acceptance: fixture schemas produce stable catalogs; required+unique+rename classified unsafe; optional field + index classified safe
+
+- [x] **Task 3.2**: `generate` CLI writes a timestamped file
+  - Delivers: `terreno-migrate generate --dir --models`; uses last `schemaAfter`; no-op diff exits 0; unsafe ops emit throwing stub; generated `up` honors `dryRun` for safe index ops
+  - Files: `api/src/migrations/generate.ts`, `api/src/migrations/generate.test.ts`, CLI subcommand
+  - Blocked by: 2.2, 3.1
+  - Skills: `mongoose-schema-safety`, `update-docs`
+  - Docs: generate workflow on the how-to
+  - Acceptance: temp dir tests — first generate from empty snapshot; second generate no-op; required-field stub throws in dry-run and wet
+
+## Phase 4 — Boot hook
+
+- [x] **Task 4.1**: `TerrenoApp` `migrations.runOnStart`
+  - Delivers: option default off; when true, wet `up` after DB connect before listen; prod still needs `ALLOW_MIGRATIONS`; failure prevents listen
+  - Files: `api/src/terrenoApp.ts`, `api/src/terrenoApp.migrations.test.ts` (or extend existing app tests)
+  - Blocked by: 2.2
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: option table in api.md
+  - Acceptance: tests — omitted option does not query `terreno_migrations`; `runOnStart: true` applies pending; prod without env throws before listen
+
+## Phase 5 — Admin HTTP
+
+- [x] **Task 5.1**: Admin migrations routes + config flag
+  - Delivers: `GET /admin/migrations/status` and `POST /admin/migrations/run?wetRun=` as `modelRouter` collection actions; creates BackgroundTask and runs batch pending; poll/cancel via existing script task routes; prod wet 403 without `ALLOW_MIGRATIONS`; `GET /admin/config` includes `migrations.enabled`
+  - Files: `admin-backend/src/adminApp.ts`, `admin-backend/src/adminApp.migrations.test.ts`, AdminApp options type
+  - Blocked by: 1.2, 2.1
+  - Skills: `terreno-backend-api`, `building-admin-interfaces`, `backend-test-env`
+  - Docs: `docs/reference/admin-config.md` + admin-backend reference
+  - Acceptance: 201 + taskId; dry-run does not persist applied ids; non-admin 403; unknown when migrations not configured 404
+
+## Phase 6 — Admin UI
+
+- [x] **Task 6.1**: Migrations page, nav, spa route
+  - Delivers: `__migrations` screen distinct from `__scripts`; status list; Dry run / Apply pending; reuse task polling (script-runner modal or equivalent); shell nav when `migrations.enabled`
+  - Files: `admin-frontend/src/AdminMigrations.tsx`, tests, `AdminShell.tsx`, `AdminScreenRouter.tsx`, types; `admin-spa` route
+  - Blocked by: 5.1
+  - Skills: `terreno-ui`, `building-admin-interfaces`, `verify-ui-changes`, `update-docs`
+  - Docs: `docs/how-to/build-admin-screens.md` nav note
+  - Acceptance: frontend tests for routing/nav; browser verification of dry-run vs apply on example admin (artifacts under `/opt/cursor/artifacts/`)
+
+## Phase 7 — Example, CI, agent docs
+
+- [x] **Task 7.1**: example-backend wiring + reversible fixture
+  - Delivers: `example-backend/migrations/` with a reversible index (or no-op) migration; package scripts `migrate:check` / `migrate:up` / `migrate:status`; test `exerciseReversibleMigrations`; do not wipe `terreno_migrations` in seed reset
+  - Files: `example-backend/package.json`, `example-backend/src/server.ts` (pass `migrations` into AdminApp + TerrenoApp), seed reset guard, tests
+  - Blocked by: 2.2, 5.1
+  - Skills: `update-docs`, `backend-test-env`
+  - Docs: example commands on the how-to
+  - Acceptance: `bun test` in example-backend covers migrate check + up/down; seed `--reset` leaves history collection
+
+- [x] **Task 7.2**: Diátaxis, changelog, mongoose-schema-safety
+  - Delivers: how-to complete; api/env/admin reference; skill tells authors to use versioned migrations for backfills; `CHANGELOG.md` Added; `bun run skills:sync` / `bun run rules` if the skill source changed
+  - Files: `docs/how-to/run-mongodb-migrations.md`, `docs/how-to/README.md`, `docs/reference/*`, `docs/how-to/seed-a-database.md`, `plugins/terreno-planning/skills/mongoose-schema-safety/SKILL.md` (canonical then sync), `CHANGELOG.md`
+  - Blocked by: 3.2, 4.1, 6.1, 7.1 (content must match shipped CLI/UI)
+  - Skills: `update-docs`
+  - Acceptance: stranger can generate → dry-run → up from the how-to; skill no longer points only at ad-hoc `ScriptRunner` backfills

package/dist/docs/versioned/57.18.0/tasks/notification-center.md

@@ -0,0 +1,102 @@
+# Tasks: In-app notification center
+
+IP: [notification-center.md](../implementationPlans/notification-center.md)  
+**Closes:** https://github.com/TerrenoLabs/terreno/issues/1179
+
+**Feature profile:** false (full IP)
+
+## Phase 1 — Tracer (inbox write + sync)
+
+- [x] **Task 1.1**: Notification model + `NotificationsApp` + `notify()` inbox write
+  - Delivers: `new NotificationsApp()` registers owner-scoped `/notifications` with `create: []`, `sync: {scope: {type: "owner"}}`, `isDeletedPlugin` + `syncPlugin`; `getNotificationService().notify({userId, title, body, href?, kind?})` inserts a row and change-stream/sync can see it; HTTP/sync create is 403/nack
+  - Files: `api/src/models/notification.ts`, `api/src/types/notification.ts`, `api/src/notifications/notificationsApp.ts`, `api/src/notifications/notificationService.ts`, `api/src/notifications/notificationsApp.test.ts`, `api/src/index.ts`
+  - Blocked by: none
+  - Skills: `terreno-backend-api`, `mongoose-schema-safety`, `backend-test-env`, `update-docs`
+  - Docs: stub **In-app notifications** in `docs/reference/api.md` (do not mix with Slack/Zoom notifiers)
+  - Acceptance: bun + supertest — `notify` creates one owner row; unauthenticated list 401; other user cannot read; POST `/notifications` 403 or disabled; every schema field has `description`
+
+- [x] **Task 1.2**: Owner mark-read and dismiss
+  - Delivers: `preUpdate` allows only `readAt` (ISO/date or `null`); `delete` soft-deletes; other fields in PATCH are stripped/rejected; unread query is `readAt` unset/null
+  - Files: `api/src/notifications/notificationsApp.ts`, tests in `notificationsApp.test.ts`
+  - Blocked by: 1.1
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: one sentence on patch/delete in the api.md stub
+  - Acceptance: bun tests — PATCH `{readAt}` persists; PATCH `{title: "x"}` does not change title; DELETE hides from list; second user 403
+
+## Phase 2 — Preferences, comms fan-out, retention
+
+- [x] **Task 2.1**: Preference model + defaults + `notificationsBeforeSend`
+  - Delivers: `NotificationPreference` unique `ownerId`, four booleans default true; missing row treated as all on; export duck-typed `notificationsBeforeSend({channel, userId})` that cancels when that boolean is false (`verification` channel never cancelled by this hook)
+  - Files: `api/src/models/notificationPreference.ts`, `api/src/types/notificationPreference.ts`, preference router on `NotificationsApp`, tests
+  - Blocked by: 1.1
+  - Skills: `terreno-backend-api`, `mongoose-schema-safety`, `backend-test-env`
+  - Docs: prefs table in api.md stub
+  - Acceptance: bun tests — no row → beforeSend does not cancel; `mail: false` → `{cancel: true}` for `channel: "mail"`; inapp false → `notify` does **not** insert a Notification
+
+- [x] **Task 2.2**: Optional comms fan-out from `notify()`
+  - Delivers: `NotificationsApp({getComms})`; after inbox write, call `sendMail` / `sendSms` / `sendPushToUser` when that pref is on and destination exists (email from User, phone if present on user, push via comms); missing `getComms` or missing destination skips that channel without failing `notify`; do not import `@terreno/comms` from `@terreno/api`
+  - Files: `api/src/notifications/notificationService.ts`, tests with a fake `getComms`
+  - Blocked by: 2.1
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: fan-out order in api.md
+  - Acceptance: bun tests — fake mail called when pref on + email present; mail not called when pref off; `notify` resolves when `getComms` throws after inbox write (log `logger.error`, still return the notification id)
+
+- [x] **Task 2.3**: Mark-all-read + `retainDays`
+  - Delivers: `POST /notifications/mark-all-read` sets `readAt` on the caller's unread rows; `retainDays` default `0` (no sweep); `retainDays > 0` tombstones (`deleted`) rows with `created` older than N days (best-effort on `notify` and/or a small `sweepExpired()`); **no** Mongo TTL index
+  - Files: `notificationsApp.ts`, `notificationService.ts`, tests
+  - Blocked by: 1.2
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: `retainDays` default 0 in api.md
+  - Acceptance: bun tests — mark-all-read only affects caller; retainDays 0 leaves old rows; retainDays 1 tombstones a row dated 2 days ago via Luxon; collection indexes do not include a TTL expireAfterSeconds on Notification
+
+## Phase 3 — UI
+
+- [x] **Task 3.1**: `NotificationBell` + `NotificationInbox`
+  - Delivers: presentational components (no syncdb import); bell shows badge from `unreadCount`; inbox lists items, mark read/unread, dismiss, tap calls `onOpen`; empty and loading states; `testID`s
+  - Files: `ui/src/NotificationBell.tsx`, `ui/src/NotificationInbox.tsx`, tests, `ui/src/index.tsx` exports
+  - Blocked by: none
+  - Skills: `terreno-ui`, `update-docs`, `verify-ui-changes`
+  - Docs: stub props in `docs/reference/ui.md`
+  - Acceptance: bun `ui` tests with `renderWithTheme`; badge hidden at 0; `onOpen` fired with the item; dismiss/mark callbacks fired
+
+- [x] **Task 3.2**: `NotificationPreferences`
+  - Delivers: four `BooleanField`s bound to `{inapp, mail, push, sms}`; `onChange` per channel
+  - Files: `ui/src/NotificationPreferences.tsx`, test, export
+  - Blocked by: none
+  - Skills: `terreno-ui`
+  - Docs: prefs props in ui.md
+  - Acceptance: bun tests — toggling mail calls `onChange("mail", false)`
+
+- [x] **Task 3.3**: Demo stories
+  - Delivers: demoConfig entries with fixture unread/read items and prefs toggles
+  - Files: `demo/stories/` + `demo/demoConfig.tsx` (or current demo registration)
+  - Blocked by: 3.1, 3.2
+  - Skills: `terreno-ui`, `verify-ui-changes`
+  - Docs: none (4.1)
+  - Acceptance: demo route renders bell + inbox + prefs without a backend
+
+## Phase 4 — Example app + docs
+
+- [x] **Task 4.1**: example-backend register + demo notify
+  - Delivers: `NotificationsApp({getComms: getCommsService})`; compose `notificationsBeforeSend` into `CommsApp` `beforeSend`; authenticated demo route (follow `commsDev`) that `notify`s the current user
+  - Files: `example-backend/src/server.ts`, `example-backend/src/api/` demo route + test
+  - Blocked by: 2.2, 2.3
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: none (4.3)
+  - Acceptance: bun tests — registered routes exist; demo notify 401 without auth; 200 with auth creates a row
+
+- [x] **Task 4.2**: example-frontend syncdb + bell + prefs
+  - Delivers: collections `notifications` and `notification-preferences`; bell on todos header; settings preferences screen; `onOpen` uses Expo Router for in-app `href`; optional “send test” calling the demo route
+  - Files: `example-frontend/store/syncdb.ts` (codegen/list), todos screen, settings route, tests if present
+  - Blocked by: 3.1, 3.2, 4.1
+  - Skills: `terreno-data-fetching`, `terreno-ui`, `verify-ui-changes`, `generate-sdk` (only if a non-sync demo route needs SDK)
+  - Docs: none (4.3)
+  - Acceptance: `useQuery` lists notify rows after demo send; mark read persists; prefs toggle survives reload (syncdb); no new RTK CRUD hooks for the collection
+
+- [x] **Task 4.3**: Diátaxis docs + rules + changelog
+  - Delivers: `docs/how-to/in-app-notifications.md`; finish `docs/reference/api.md` and `docs/reference/ui.md`; `docs/reference/comms.md` beforeSend composition; `docs/how-to/README.md` link; `.rulesync/rules/api` mention + `bun run rules`; `changelog/unreleased/notification-center.md`
+  - Files: those docs + rules
+  - Blocked by: 4.2
+  - Skills: `update-docs`
+  - Docs: (this task)
+  - Acceptance: a stranger can register the plugin and wire the bell from the how-to without reading the IP; website/how-to index lists the page

package/dist/docs/versioned/57.18.0/tasks/org-management-ui.md

@@ -0,0 +1,107 @@
+# Tasks: Organizations as a first-class primitive (admin UI + RBAC)
+
+IP: [org-management-ui](../implementationPlans/org-management-ui.md)
+
+Supporting skills (all tasks): `update-docs`. Models: `mongoose-schema-safety`. API tests: `backend-test-env`. Admin UI: `terreno-ui`, `building-terreno-apps`, `verify-ui-changes`. SDK: `generate-sdk`. Data: `terreno-data-fetching`.
+
+## Phase 1 — Models + context
+
+- [x] **Task 1.1**: Organization + Membership models
+  - Delivers: persist orgs and per-org `roleName` (`org-admin` \| `member`)
+  - Files: `api/src/orgs/organizationModel.ts`, types, `api/src/orgs/*.test.ts`
+  - Blocked by: none
+  - Docs: field `description`s (OpenAPI); note in `docs/reference/api.md` stub section if the page is updated later in 6.1
+  - Acceptance: unit tests for compound unique index and duplicate membership rejection
+- [x] **Task 1.2**: `orgScopedPlugin`
+  - Delivers: required indexed `organizationId` on consumer schemas
+  - Files: `api/src/orgs/orgPlugin.ts` + tests
+  - Blocked by: 1.1
+  - Docs: none until 6.1
+  - Acceptance: save without org fails; index present
+- [x] **Task 1.3**: Org context middleware + `OrgQueryFilter`
+  - Delivers: Q13 header matrix; lists never cross orgs
+  - Files: `api/src/orgs/orgContext.ts`, `orgPermissions.ts`, `api/src/permissions.ts` (stop using `User.organizationIds`)
+  - Blocked by: 1.1, 1.2
+  - Docs: none until 6.1
+  - Acceptance: supertest — operator missing header on scoped list → 400; org-admin of one org omits header → scoped; org A member never reads org B including `$or` / query-param attacks; non-member header → 403
+
+## Phase 2 — RBAC
+
+- [x] **Task 2.1**: `organization` statements + `operator` role + membership-scoped `org-admin`
+  - Delivers: platform vs org grants as in the IP tables
+  - Files: `api/src/rbac/statements.ts`, `roleModel.ts`, resolve/can path for Membership `roleName`, tests
+  - Blocked by: 1.3
+  - Docs: `docs/reference/api.md` RBAC/org note (or 6.1)
+  - Acceptance: `org-admin` on org A cannot `organization:list` all orgs; `operator` can; `user.roles` containing `org-admin` is not how grants work (test that membership wins)
+
+## Phase 3 — OrgsApp routes
+
+- [x] **Task 3.1**: Operator org CRUD + `/orgs/mine`
+  - Delivers: create/list-all/mine/read/patch/soft-delete + `onOrgAudit`
+  - Files: `api/src/orgs/orgsApp.ts`, exports, OpenAPI, supertest
+  - Blocked by: 2.1
+  - Docs: none until 6.1
+  - Acceptance: org-admin 403 on `GET /orgs`; operator 200; create does not require membership; disable/soft-delete suspends memberships
+- [x] **Task 3.2**: Members attach / patch / delete + last-admin guards
+  - Delivers: existing-user attach; no email; last `org-admin` protected
+  - Files: `api/src/orgs/orgsApp.ts` + tests
+  - Blocked by: 3.1
+  - Docs: none until 6.1
+  - Acceptance: attach by email of existing user; unknown email 404; demote last org-admin 400; no comms/send invoked
+
+## Phase 4 — Admin backend
+
+- [x] **Task 4.1**: Admin org routes + AdminApp tenant context
+  - Delivers: admin UI can call org APIs; generic admin model lists use context filter
+  - Files: `admin-backend/src/*` (org registration or aliases), AdminApp queryFilter/preCreate, tests
+  - Blocked by: 3.2
+  - Docs: `docs/reference/admin-backend.md` org section (may land with 6.1)
+  - Acceptance: operator `/admin` list of an org-scoped model without header → 400; with header → only that org; org-admin cannot hit all-orgs admin list
+
+## Phase 5 — Admin frontend
+
+- [x] **Task 5.1**: `OrgDirectoryScreen` (operator)
+  - Delivers: all-orgs table, create, disable, enter org
+  - Files: `admin-frontend/src/orgs/OrgDirectoryScreen.tsx` + tests
+  - Blocked by: 4.1
+  - Docs: `docs/reference/admin-frontend.md` component section
+  - Acceptance: loading/error/empty; org-admin nav hidden in unit test via role prop/fixture
+- [x] **Task 5.2**: `OrgSwitcher` + `useOrgContext` (header + URL)
+  - Delivers: Q10/Q13 client behavior for org-admins and operators-in-org
+  - Files: `admin-frontend/src/orgs/OrgSwitcher.tsx`, `useOrgContext.tsx`, `AdminShellLayout` slot
+  - Blocked by: 5.1
+  - Docs: admin-frontend reference
+  - Acceptance: switching sets `X-Organization-Id` on subsequent admin queries (test with mocked api); single-org org-admin still renders org name
+- [x] **Task 5.3**: Org settings + members table
+  - Delivers: settings PATCH; members DataTable; add existing user; last-admin error; disabled Invite; billing placeholder
+  - Files: `admin-frontend/src/orgs/OrgSettingsScreen.tsx`, `OrgMembersScreen.tsx` + tests
+  - Blocked by: 5.2, 3.2
+  - Docs: admin-frontend reference
+  - Acceptance: Invite control disabled; billing placeholder visible; last-admin error shown
+- [x] **Task 5.4**: Host wiring — admin-spa + example-frontend `/admin`
+  - Delivers: routes on both hosts; SDK regen
+  - Files: `admin-spa/app/orgs/*`, `example-frontend/app/admin/orgs/*`, `example-frontend/store/openApiSdk.ts` (generated)
+  - Blocked by: 5.3
+  - Docs: `docs/reference/admin-spa.md` nav entry
+  - Acceptance: `cd example-frontend && bun run sdk` compiles; both apps have `/admin/orgs` routes
+- [x] **Task 5.5**: Frontend verification
+  - Delivers: evidence org-admin vs operator flows
+  - Files: `/opt/cursor/artifacts/` (not in repo)
+  - Blocked by: 5.4, 6.2
+  - Docs: none
+  - Acceptance: login operator → directory → create/open org → members; login org-admin → no directory → switcher → members only that org; screenshots/video on the PR (`verify-ui-changes`)
+
+## Phase 6 — Example + docs
+
+- [x] **Task 6.1**: Docs (same slice as behavior; can land incrementally but must be complete before Brew)
+  - Delivers: stranger can operate orgs from docs
+  - Files: `docs/how-to/add-organizations.md`, `docs/explanation/organizations.md`, `docs/reference/api.md`, `docs/reference/admin-backend.md`, `docs/reference/admin-frontend.md`, `docs/reference/admin-spa.md`, `.rulesync/**` if agent rules need org context
+  - Blocked by: 4.1 (content must match shipped routes)
+  - Docs: (this task)
+  - Acceptance: `bun run website:build` (or package docs check used in CI); how-to has one minimal OrgsApp + AdminApp example
+- [x] **Task 6.2**: example-backend migration + seeds
+  - Delivers: Membership instead of `User.organizationIds`; operator + two org-admins
+  - Files: `example-backend/src/models/user.ts`, `types/models/userTypes.ts`, `api/projects.ts`, `scripts/seed-*`, `access.ts`, `rbacRoles.ts`, tests
+  - Blocked by: 3.2, 2.1
+  - Docs: seed users named in `docs/how-to/add-organizations.md`
+  - Acceptance: grep finds no `organizationIds` on User; isolation tests pass; seed creates operator@example.com

package/dist/docs/versioned/57.18.0/tasks/orgs-and-teams.md

@@ -0,0 +1,72 @@
+# Tasks: Organizations, teams, and multi-tenant scoping
+
+**Superseded.** Do not execute. Canonical tasks: [org-management-ui](org-management-ui.md).
+
+IP: [orgs-and-teams](../implementationPlans/orgs-and-teams.md) (superseded by [org-management-ui](../implementationPlans/org-management-ui.md))
+
+## Phase 1 — Models + plugin
+
+- [ ] **Task 1.1**: Organization + Membership models
+  - Description: schemas per IP (five-type pattern, descriptions, plugins, compound unique index), statics `findActiveForUser`/`isMember`/`isOrgAdmin`
+  - Files: `api/src/orgs/organizationModel.ts`, type files
+  - Depends on: none
+  - Acceptance: unit tests incl. duplicate-membership rejection
+- [ ] **Task 1.2**: `orgScopedPlugin`
+  - Description: adds required indexed `organizationId` to a schema
+  - Files: `api/src/orgs/orgPlugin.ts`
+  - Depends on: 1.1
+  - Acceptance: plugin test on a sample schema; save without org fails
+
+## Phase 2 — Context + permissions
+
+- [ ] **Task 2.1**: Org context middleware
+  - Description: `X-Organization-Id` → `req.organization`/`req.membership`; 403 on non-membership; no header → no context
+  - Files: `api/src/orgs/orgContext.ts`
+  - Depends on: 1.1
+  - Acceptance: supertest for member/non-member/missing header
+- [ ] **Task 2.2**: `IsOrgMember`, `IsOrgAdmin`, `OrgQueryFilter`
+  - Description: permission methods + query filter (header-scoped or all-memberships)
+  - Files: `api/src/orgs/orgPermissions.ts`
+  - Depends on: 2.1
+  - Acceptance: **tenant isolation suite** — org A member never reads org B rows, incl. crafted `$or`/query-param attempts
+- [ ] **Task 2.3**: modelRouter integration + `preCreate` org injection helper
+  - Description: end-to-end org-scoped CRUD on a test model
+  - Files: `api/src/orgs/*`, `api/src/tests.ts`
+  - Depends on: 2.2
+  - Acceptance: create injects context org; list/read/update/delete respect scope
+
+## Phase 3 — Routes + app
+
+- [ ] **Task 3.1**: `OrgsApp` plugin + org CRUD routes
+  - Description: create (with `maxOrgsPerUser`), list-my-orgs, read, patch, soft delete with membership cascade
+  - Files: `api/src/orgs/orgsApp.ts`
+  - Depends on: Phase 2
+  - Acceptance: supertest per route; OpenAPI entries present
+- [ ] **Task 3.2**: Member management routes + last-admin guards
+  - Description: list/patch/delete members; cannot demote/remove last admin
+  - Files: `api/src/orgs/orgsApp.ts`
+  - Depends on: 3.1
+  - Acceptance: guard tests pass
+- [ ] **Task 3.3**: `onOrgAudit` hook + exports
+  - Description: audit hook mirroring `onAdminAudit`; public exports from `@terreno/api`
+  - Files: `api/src/orgs/orgsApp.ts`, `api/src/index.ts`
+  - Depends on: 3.1
+  - Acceptance: hook fires for create/role-change/delete in tests
+
+## Phase 4 — Example + docs
+
+- [ ] **Task 4.1**: example-backend org-scoped `Project` model + routes + seeds
+  - Description: demo model with `orgScopedPlugin` + `OrgQueryFilter`; seed two orgs with distinct data
+  - Files: `example-backend/src/models/project.ts`, `src/api/projects.ts`, `scripts/seed*`
+  - Depends on: Phase 3
+  - Acceptance: seeded backend proves isolation via curl/supertest
+- [ ] **Task 4.2**: Admin registration + SDK regen
+  - Description: register Organization/Membership in AdminApp; `cd example-frontend && bun run sdk`
+  - Files: `example-backend/src/server.ts`, `example-frontend/store/openApiSdk.ts`
+  - Depends on: 4.1
+  - Acceptance: admin panel lists orgs; SDK compiles
+- [ ] **Task 4.3**: Docs
+  - Description: `docs/how-to/add-organizations.md`, reference updates, rulesync
+  - Files: `docs/how-to/add-organizations.md`, `docs/reference/api.md`, `.rulesync/**`
+  - Depends on: Phase 3
+  - Acceptance: `bun run rules:check` passes

package/dist/docs/versioned/57.18.0/tasks/password-reset-and-email-verification.md

@@ -0,0 +1,60 @@
+# Tasks: Password reset and email verification
+
+IP: [password-reset-and-email-verification](../implementationPlans/password-reset-and-email-verification.md)
+
+## Phase 1 — Token infrastructure
+
+- [x] **Task 1.1**: `AuthToken` model + issue/consume statics
+  - Description: hashed single-use tokens with TTL expiry per IP
+  - Files: `api/src/authTokens.ts`, type files
+  - Depends on: none
+  - Acceptance: atomic single-use test (parallel consumes → one winner); expiry test
+- [x] **Task 1.2**: `emailVerificationPlugin`
+  - Description: `emailVerified` field plugin for user schemas
+  - Files: `api/src/plugins.ts`
+  - Depends on: none
+  - Acceptance: plugin test; example User adopts it
+
+## Phase 2 — JWT routes + mail
+
+- [x] **Task 2.1**: forgot/reset routes
+  - Description: 202-always forgot; reset validates+consumes token, `setPassword`, invalidates refresh tokens; RTK client path/shape contract verified
+  - Files: `api/src/authRecovery.ts`, `api/src/auth.ts`
+  - Depends on: 1.1, comms-abstraction
+  - Acceptance: enumeration-safety + happy-path supertest; RTK-shape test
+- [x] **Task 2.2**: verification routes + `requireEmailVerification` option
+  - Description: sendVerification/verifyEmail; 403 `email-not-verified` gating on login when enabled
+  - Files: `api/src/authRecovery.ts`, `api/src/auth.ts`
+  - Depends on: 1.2, 2.1
+  - Acceptance: gating on/off supertest
+- [x] **Task 2.3**: Mail templates
+  - Description: `resetPassword` + `verifyEmail` templates with app-override hook and `publicAppUrl` links
+  - Files: `comms/src/templates.ts`
+  - Depends on: comms-abstraction Phase 1
+  - Acceptance: rendered output snapshot tests
+
+## Phase 3 — Better Auth parity
+
+- [x] **Task 3.1**: Better Auth hooks
+  - Description: `sendResetPassword`/`sendVerificationEmail` wired to the same templates
+  - Files: `api/src/betterAuthSetup.ts`
+  - Depends on: 2.3
+  - Acceptance: parity test asserting identical template usage
+
+## Phase 4 — Client + docs
+
+- [x] **Task 4.1**: example-frontend reset screen + verify banner
+  - Description: `/resetPassword` route + profile banner with re-send; SDK regen
+  - Files: `example-frontend/app/resetPassword.tsx`, `app/(tabs)/profile.tsx`, `store/openApiSdk.ts`
+  - Depends on: Phase 2
+  - Acceptance: end-to-end flow with console adapter; UI verification evidence per verify-ui-changes
+- [x] **Task 4.2**: `LoginScreen` forgot-password link prop
+  - Description: optional `onForgotPassword` on `@terreno/ui` LoginScreen
+  - Files: `ui/src/login/LoginScreen.tsx` + tests + demo story
+  - Depends on: none
+  - Acceptance: renders only when provided; story added
+- [x] **Task 4.3**: Docs
+  - Description: how-to + env reference + rulesync
+  - Files: `docs/how-to/password-reset.md`, `docs/reference/environment-variables.md`, `.rulesync/**`
+  - Depends on: Phase 2
+  - Acceptance: `bun run rules:check` passes

package/dist/docs/versioned/57.18.0/tasks/positioning-django-rails-universal.md

@@ -0,0 +1,100 @@
+# Task List: Positioning — "Django/Rails for TypeScript, with Universal Apps"
+
+See: [`docs/implementationPlans/positioning-django-rails-universal.md`](../implementationPlans/positioning-django-rails-universal.md)
+
+**RTK deprecation flag:** **Partial.** Tasks marked `[RTK]` touch the architecture diagram, package list, or integration flow and must run after PR #869 merges and after [`rtk-to-syncdb-migration-docs`](rtk-to-syncdb-migration-docs.md) Phase 6. Unmarked tasks are safe earlier.
+
+## Instructions for the implementing agent
+
+- Write the copy blocks **once** in `docs/explanation/positioning.md` (Task 1.1), then copy them verbatim everywhere else. Do not paraphrase per surface — drift is the problem this IP exists to fix.
+- Do not claim any feature listed under "Where Terreno is headed" as shipped. If you are unsure whether something ships today, grep for it in the package source before writing about it.
+- When moving content out of the README, use `git mv`-style discipline: cut from one file, paste into the other in the same commit, and grep for inbound links.
+- Run `bun run website:build` and `bun run rules:check` before each commit that touches `website/` or `.rulesync/`.
+
+## Phase 1: Canonical copy
+
+- [x] **Task 1.1**: Write `docs/explanation/positioning.md`
+  - Description: New explainer containing five clearly-labeled copy blocks in fenced code blocks (so they can be copied verbatim without markdown rendering surprises): `tagline` (one line), `elevator` (2–3 sentences), `pillars` (three bullets, in the order batteries-included / universal-by-default / AI-native), `aiPillar` (2–3 sentences naming both AI layers per IP question PO7 — the MCP tool layer and the `/terreno-*` SDLC pipeline process layer), and `pitch` (~150 words). Then a "Why the Django/Rails analogy" section, then the honest comparison table from the IP. Then a "Language rules" section restating the four rules from the program doc (lead with the analogy, say "universal app", never claim unshipped features, keep superlatives off reference pages) plus a fifth: never describe one AI layer without the other.
+  - Files: `docs/explanation/positioning.md` (new)
+  - Depends on: none
+  - Acceptance: five fenced copy blocks present and labeled; the `aiPillar` block names both the MCP tools and the `/terreno-*` pipeline; comparison table has at least eight rows including at least three honest gaps with IP links; language rules section has all five rules.
+
+- [x] **Task 1.2**: Verify every claim in the comparison table
+  - Description: For each row of the comparison table, confirm the Terreno side exists by finding it in source: `modelRouter` in `api/src/api.ts`, admin packages, `Permissions` in `api/src/permissions.ts`, Better Auth in `api/src/betterAuth*.ts`, MCP tools in `mcp-server/src/tools.ts`, and the SDLC pipeline in `plugins/terreno-planning/skills/`. For each "not shipped" row (background jobs, SSR, RBAC), confirm it is genuinely absent and link the IP or roadmap item tracking it. Correct any row that turns out to be wrong.
+  - Files: `docs/explanation/positioning.md`
+  - Depends on: Task 1.1
+  - Acceptance: every "shipped" row cites a source path; the generator row cites both `mcp-server/src/tools.ts` and `plugins/terreno-planning/`; every "not shipped" row links an IP file that exists in `docs/implementationPlans/`.
+
+- [x] **Task 1.3**: Gate the pipeline claim on its portability work
+  - Description: The `/terreno-*` pipeline currently only runs inside this monorepo (see [`agentic-sdlc-plugin`](../implementationPlans/agentic-sdlc-plugin.md), "It only works here"). Do not publish positioning copy that implies consumers can use it until that IP's Phase 2 is complete. Check the state of `agentic-sdlc-plugin` Task 2.5 before writing the `aiPillar` block; if portability is not done, write the block describing the tool layer only and add a `TODO` in the IP to revisit, rather than making a claim that fails on first use.
+  - Files: `docs/explanation/positioning.md`
+  - Depends on: Task 1.1
+  - Acceptance: the `aiPillar` block claims the pipeline only if `agentic-sdlc-plugin` Task 2.5 has passed; otherwise the omission is recorded with a pointer to the blocking task.
+
+## Phase 2: README restructure
+
+- [x] **Task 2.1**: Restructure the README's opening
+  - Description: Rewrite `README.md` above the packages list to this order: title with badges (preserve existing npm badges and the license badge from the governance IP), the `tagline` block as the subtitle, the `elevator` block, the three `pillars`, then a "Quickstart" section, then "Packages". Preserve the existing Vision and Philosophy content but fold it into the pillars rather than repeating it. Per IP question PO5, replace the "Where Terreno is headed" list with a two-line summary linking `ROADMAP.md`.
+  - Files: `README.md`
+  - Depends on: Task 1.1
+  - Acceptance: "Django/Rails for TypeScript" appears within the first two sentences; the pillars appear in the IP's order; the roadmap section is two lines plus a link; no feature claimed that is not shipped.
+
+- [x] **Task 2.2**: Move maintainer content out of the README
+  - Description: Move these README sections to their correct homes: local development / bootstrap / linking instructions → `CONTRIBUTING.md`; the "Feature flags: OpenFeature migration" walkthrough → a new or existing page under `docs/how-to/` (check `docs/how-to/add-feature-flags.md` first — it may already cover this, in which case delete the README copy and link it); GCP project names, Cloud Run URLs, and Netlify hosts → `infra/flourish/README.md` (created by [`deploy-to-gcp`](../implementationPlans/deploy-to-gcp.md)) or a short "Live examples" list with URLs only and no infra detail; release instructions → `CONTRIBUTING.md`. After moving, grep the repo and `website/` for links to the removed anchors and fix them.
+  - Files: `README.md`, `CONTRIBUTING.md`, `docs/how-to/add-feature-flags.md`, `infra/flourish/README.md`
+  - Depends on: Task 2.1
+  - Acceptance: `rg -i "flourish-terreno|a\.run\.app|Slack" README.md` returns nothing; no content was deleted without a new home; `bun run website:build` reports no new broken links.
+
+- [x] **Task 2.3**: `[RTK]` Update the README architecture and package list
+  - Description: Confirm the architecture diagram and published-package list reflect syncdb (this may already be done by `rtk-to-syncdb-migration-docs` Task 6.5 — check first and skip if so). Ensure every package in `publish-on-tag.yml` appears in the list exactly once with a one-line description matching its `package.json` description.
+  - Files: `README.md`
+  - Depends on: Task 2.2, `rtk-to-syncdb-migration-docs` Task 6.5
+  - Acceptance: package list matches `publish-on-tag.yml` one-to-one; each description matches the package's `package.json`; diagram names syncdb not rtk.
+
+## Phase 3: Docs site
+
+- [x] **Task 3.1**: `[RTK]` Rewrite `docs/README.md`
+  - Description: Replace the opening line ("shared packages for full-stack applications with React Native and Express/Mongoose") with the `tagline` + `elevator` + `pillars` blocks. Keep the Diátaxis structure section. Rebuild the package table so it contains every published package including `@terreno/ai`, `@terreno/syncdb`, `@terreno/admin-spa`, and `@terreno/feature-flags`, with `rtk` under a Legacy heading. Update the Quick links section: remove the `.cursorrules` link if that file no longer exists, add `positioning.md`, `ROADMAP.md`, and `CONTRIBUTING.md`.
+  - Files: `docs/README.md`
+  - Depends on: Task 1.1, `rtk-to-syncdb-migration-docs` Task 2.3
+  - Acceptance: tagline appears in the first two sentences; package table complete and matching `publish-on-tag.yml`; every Quick link resolves to an existing file.
+
+- [x] **Task 3.2**: Update the docs site configuration
+  - Description: In `website/docusaurus.config.ts`, set `tagline` to the canonical tagline and confirm `title`, `themeConfig.metadata` (og description), and navbar title read consistently. Check whether `website/src/pages/index.tsx` exists; if it does, update the hero to use the tagline, the three pillars, and one short code sample (a `modelRouter` registration plus the matching generated hook usage). If there is no custom landing page, note that in the PR body and skip the hero work.
+  - Files: `website/docusaurus.config.ts`, `website/src/pages/index.tsx` (if present)
+  - Depends on: Task 1.1
+  - Acceptance: `bun run website:build` succeeds; the built HTML contains the canonical tagline in the meta description; the hero (if present) shows the three pillars.
+
+## Phase 4: Agent surfaces
+
+- [x] **Task 4.1**: `[RTK]` Update root agent context files
+  - Description: In `.rulesync/rules/00-root.md` (the source for `AGENTS.md`, `CLAUDE.md`, `.cursor/rules/00-root.mdc`, and the copilot instructions), replace the opening "A monorepo containing shared packages…" with the `tagline` + `elevator` + `pillars`. Keep all existing conventions content unchanged. Apply the same opening to `CLAUDE-consumer.md`. Then run `bun run rules` and commit every generated mirror. Note: `CLAUDE.local.md` appears to be a stale duplicate of `CLAUDE.md` — verify and either update or delete it, reporting which you chose and why.
+  - Files: `.rulesync/rules/00-root.md`, `CLAUDE-consumer.md`, possibly `CLAUDE.local.md`, generated mirrors
+  - Depends on: Task 1.1
+  - Acceptance: `bun run rules:check` exits 0; `AGENTS.md` and `CLAUDE.md` both open with the positioning; no conventions content was lost (diff review); the `CLAUDE.local.md` decision is explained in the PR body.
+
+- [x] **Task 4.2**: Update the MCP overview resource
+  - Description: Update `mcp-server/src/docs/resources/overview.md` to open with the positioning blocks so agents reading `terreno://docs/overview` describe Terreno consistently. Check the other resource bundles (`api`, `ui`, `rtk`/`syncdb`, `patterns`) for stale positioning language in their intros and fix those too.
+  - Files: `mcp-server/src/docs/resources/*.md`
+  - Depends on: Task 4.1
+  - Acceptance: `bun run mcp:build` succeeds; the overview resource opens with the tagline; no resource intro describes Terreno as "a monorepo of shared packages".
+
+## Phase 5: Metadata
+
+- [x] **Task 5.1**: Standardize `package.json` descriptions
+  - Description: For every package published by `publish-on-tag.yml`, set `description` to the pattern `<what it does> — part of Terreno, the batteries-included TypeScript framework for universal apps.` Keep the first clause specific and accurate per package (do not make them all identical). Also confirm `keywords`, `repository`, `homepage`, and `bugs` fields are present and correct on every published package — missing `repository` fields hurt npm discoverability.
+  - Files: every published `package.json`
+  - Depends on: Task 1.1
+  - Acceptance: every published package has a `description` matching the pattern, plus `repository`, `homepage`, and `bugs` fields; `bun install` still resolves cleanly.
+
+- [x] **Task 5.2**: Document the GitHub repository metadata
+  - Description: The repo description and topics cannot be set from a commit. Add a "Repository metadata" subsection to `docs/explanation/positioning.md` giving the exact description string (the short tagline variant from PO1 option C) and the exact topic list to set: `typescript`, `react-native`, `expo`, `express`, `mongoose`, `framework`, `mcp`, `ai`, `universal-apps`, `full-stack`. Mark it as a maintainer action.
+  - Files: `docs/explanation/positioning.md`
+  - Depends on: Task 1.1
+  - Acceptance: the exact description string and full topic list are present and marked as a manual maintainer step.
+
+- [x] **Task 5.3**: Consistency sweep
+  - Description: Grep the repo for stale positioning language and fix every hit: `rg -n "monorepo containing shared packages"`, `rg -ni "cross-platform"` (should be "universal app" in prose; library-internal technical uses are fine — judge case by case), and `rg -n "88\+ components|90\+ components"` (component counts drift; either verify the number against `ui/src/index.tsx` exports or replace with "a large component library"). Report the count of fixes in the PR body.
+  - Files: various
+  - Depends on: Task 4.1, Task 3.1
+  - Acceptance: no prose surface says "monorepo containing shared packages"; component counts are either verified against the export list or removed; `bun run rules:check` exits 0.

package/dist/docs/versioned/57.18.0/tasks/rate-limiting.md

@@ -0,0 +1,70 @@
+# Tasks: API rate limiting
+
+IP: [rate-limiting.md](../implementationPlans/rate-limiting.md)  
+**Closes:** https://github.com/TerrenoLabs/terreno/issues/1187
+
+**Feature profile:** false (full IP)
+
+## Phase 1 — Tracer (memory, TerrenoApp)
+
+- [x] **Task 1.1**: Rate-limit module + TerrenoApp mount
+  - Delivers: `rateLimit: {}` on `TerrenoApp` limits HTTP; omitted option is a no-op; `POST /auth/login` uses the auth bucket (20 / 15 min); modelRouter list uses `api` (600 / 15 min); skip `/health` and `/openapi.json`; 429 `APIError` `code: "rate-limit-exceeded"` with `Retry-After` and IETF `RateLimit` / `RateLimit-Policy`; memory store; `trust proxy` default `1` when enabled
+  - Files: `api/src/rateLimit/types.ts`, `api/src/rateLimit/store.ts`, `api/src/rateLimit/memoryStore.ts`, `api/src/rateLimit/policies.ts`, `api/src/rateLimit/middleware.ts`, `api/src/rateLimit/rateLimit.test.ts`, `api/src/terrenoApp.ts`, `api/src/index.ts`, `api/src/api.ts` (remove `TODO add rate limit`)
+  - Blocked by: none
+  - Skills: `terreno-backend-api`, `backend-test-env`, `update-docs`
+  - Docs: stub section in `docs/reference/api.md` (`rateLimit` option) so the tracer is documented when it lands
+  - Acceptance: bun tests — default off (burst login no 429); auth 20 then 429; 21st list GET still 200; 601st list 429; `/health` never 429; 429 body/headers; login classified auth
+
+## Phase 2 — Shared stores
+
+- [x] **Task 2.1**: Redis store
+  - Delivers: `store: "redis"` uses `VALKEY_URL` then `REDIS_URL`; missing URL fails startup with a clear `APIError`; consume contract matches memory
+  - Files: `api/src/rateLimit/redisStore.ts`, tests with a fake client; optional skip-if-no-redis integration
+  - Blocked by: 1.1
+  - Skills: `terreno-backend-api`
+  - Docs: store table in `docs/how-to/rate-limiting.md` (create page if 4.1 not started — Pick may write the Redis rows into the how-to started in 1.1/4.1)
+  - Acceptance: unit tests against the store interface; startup failure without URL
+
+- [x] **Task 2.2**: Mongo store
+  - Delivers: `store: "mongo"` uses the process mongoose connection and `rateLimitHits` with TTL expiry; same consume contract
+  - Files: `api/src/rateLimit/mongoStore.ts` (+ schema/types if a model is used), tests against in-memory Mongo via existing `@terreno/test` harness
+  - Blocked by: 1.1
+  - Skills: `mongoose-schema-safety` (if a Mongoose schema is added), `backend-test-env`
+  - Docs: Mongo collection / TTL note on the how-to
+  - Acceptance: two keys isolated; expiry/window reset; no public modelRouter for hits
+
+## Phase 3 — Paths and proxy
+
+- [x] **Task 3.1**: Auth path table + Better Auth / GitHub
+  - Delivers: GitHub OAuth start/callback on auth bucket; Better Auth `basePath` sign-in/sign-up/forget-password on auth; `/auth/me` on api; extra `skip` callback honored
+  - Files: `api/src/rateLimit/policies.ts`, tests
+  - Blocked by: 1.1
+  - Acceptance: supertest (or middleware unit tests with req.url) for each classified prefix
+
+- [x] **Task 3.2**: Trust-proxy keying
+  - Delivers: with `trustProxy: 1`, `X-Forwarded-For` client IP is the unauthenticated key; `trustProxy: false` ignores spoofed forwarded-for; override hop count works
+  - Files: `api/src/rateLimit/*.ts`, `api/src/terrenoApp.ts`, tests
+  - Blocked by: 1.1
+  - Acceptance: two tests (trust on vs off) with distinct `X-Forwarded-For` values
+
+## Phase 4 — Docs and example
+
+- [x] **Task 4.1**: Diátaxis + changelog + rules
+  - Delivers: operator how-to, reference, auth explanation, env reference (no enable env), replace misleading `RATE_LIMIT_*` snippet in configuration-system, Terreno 58 default-on note, `.rulesync/rules/api/00-api.mdc`, `CHANGELOG.md` Added
+  - Files: `docs/how-to/rate-limiting.md`, `docs/reference/api.md`, `docs/reference/environment-variables.md`, `docs/explanation/authentication.md`, `docs/explanation/configuration-system.md`, `.rulesync/rules/api/00-api.mdc`, `CHANGELOG.md`; `bun run rules` / `skills:sync` if required after rulesync
+  - Blocked by: 1.1 (content can land with 2.x/3.x; must match shipped stores)
+  - Skills: `update-docs`
+  - Acceptance: a stranger can enable Redis on Cloud Run from the how-to; 58 default-on is explicit; `bun run website:build` if docs site is in the slice
+
+- [x] **Task 4.2**: example-backend snippet (limiter stays off)
+  - Delivers: commented `rateLimit: process.env.RATE_LIMIT_ENABLED === "true" ? {store: "memory"} : undefined` (or equivalent) showing app-owned env
+  - Files: `example-backend/src/server.ts` (or `index`/`terrenoApp` bootstrap)
+  - Blocked by: 1.1
+  - Acceptance: default example server still has no limiter; comment compiles if uncommented
+
+- [x] **Task 4.3**: Roadmap seed + 58 upgrade stub
+  - Delivers: `docs/explanation/roadmap-seed-issues.md` `rate-limiting` section points at IP/task GitHub URLs and `IP=rate-limiting`; how-to or `mcp-server/src/docs/upgrades/` notes that Terreno 58 defaults the limiter on
+  - Files: `docs/explanation/roadmap-seed-issues.md`; upgrade note path named in how-to until 58 exists
+  - Blocked by: 4.1
+  - Skills: `update-docs`
+  - Acceptance: seed `Implementation plan` / `Tasks` links are not `*(not yet written)*`