@terreno/mcp 57.20.0 → 57.22.0

package/src/docs/versioned/57.21.0/regression/README.md

@@ -0,0 +1,87 @@
+# Regression suites
+
+Run `bun run check:regression-suites` after you edit any file here. CI runs the same check in
+the `repo-policies` job.
+
+These files hold a minimal manual pass a developer or QA walks before a release: a short check
+that the app works as intended, plus the behavior no unit test, smoke, or e2e spec can reach,
+such as push notifications, real email delivery, other hardware or operating-system behavior,
+full flows across devices, and how the app feels. Keep them small. Most features add no case
+here, and anything an e2e spec can drive and assert belongs in an e2e spec instead. Each area
+has one living file. Implementation plans
+propose cases under `## Regression cases`, and Brew writes them here with real IDs before it
+opens the pull request. See [Where regression suites live](../testing/e2e.md#where-regression-suites-live)
+for how this tier fits with the automated ones.
+
+## Areas
+
+| File | Area | Covers |
+| --- | --- | --- |
+| [planning.md](planning.md) | `PLAN` | Retired: planning-stage checks, kept so their IDs are never reused |
+| [auth.md](auth.md) | `AUTH` | Email delivery for password reset and verification, and native session storage |
+| [admin.md](admin.md) | `ADMIN` | Admin edits and announcements seen live on a phone |
+| [syncdb.md](syncdb.md) | `SYNC` | Offline writes, persistence across an app kill, and account switches on a device |
+| [ui-native.md](ui-native.md) | `NATIVE` | Notification permission prompts, finger-drawn signatures, and keyboard behavior on iOS and Android |
+
+## Suite format
+
+Every file follows the same shape:
+
+```markdown
+# Auth regression suite
+
+Area: AUTH
+Owner: <team or person>
+Last full run: 2026-01-15 (<who>, <short sha>)
+
+| ID | Case | Steps | Expected | Platforms | Automated by | Added |
+| --- | --- | --- | --- | --- | --- | --- |
+| AUTH-001 | ... | ... | ... | ... | manual | <IP slug> |
+```
+
+- **Title** is the first line, a `#` heading.
+- **`Area:`** declares the ID prefix: uppercase letters and digits. Find a suite by this line,
+  not by its file name. No two files declare the same area.
+- **`Owner:`** names the team or person who keeps the file current.
+- **`Last full run:`** is `never`, or the date, who walked it, and the short commit SHA. Change
+  it only after a person walks every case in the file.
+- **IDs** are `<AREA>-NNN`, zero-padded to three digits, and never reused. The next free ID is
+  one past the highest the file has ever held. A retired case keeps its row with `Retired` in
+  `Expected`. Provisional IP IDs such as `AUTH-new-1` never appear here.
+- **Steps** name a concrete starting state (who is signed in, what data exists, which build or
+  device), then an action a person can follow without guessing.
+- **Expected** is observable: what is on screen, in the inbox, or in the response. "It works"
+  or a restatement of the action does not count.
+- **Automated by** is `manual` or the path of the spec that covers the case. It never names an
+  IP-local `E<n>` row.
+- **Added** is the slug of the implementation plan that added the case.
+
+Escape a literal pipe inside a cell as `\|`.
+
+## What the check enforces
+
+`scripts/regression/checkSuites.ts` reads every `.md` file here except this README and fails
+when a file:
+
+- lacks the title, `Area:`, `Owner:`, or `Last full run:` line, or one of them is malformed
+- has a table whose columns differ from the seven above, or more than one table
+- has a row with the wrong number of cells, an ID that is not `<AREA>-NNN`, a `-new-` ID, or a
+  duplicate ID
+- has an empty cell, including Steps and Expected
+- names an `E<n>` row in Automated by
+
+It also fails when two files declare the same area. It does not judge whether a step meets the
+bar above; reviewers do.
+
+## Add a case
+
+1. Open the area's file, or create `<area>.md` with `Last full run: never` and an `Owner:`.
+2. Add a row with the next free ID.
+3. Run `bun run check:regression-suites`.
+
+## Backfill the suites
+
+To find cases an older feature should have had, run the `backfill-regression` skill. It
+surveys the app for behavior automation cannot reach, proposes cases one area at a time, and
+writes only the sets you approve. It records denied cases in
+`.terreno/regression-backfill.json` (not committed) so it never proposes them again.

package/src/docs/versioned/57.21.0/regression/admin.md

@@ -0,0 +1,13 @@
+# Admin regression suite
+
+Area: ADMIN
+Owner: Josh Gachnang
+Last full run: never
+
+Walk these cases with an admin account on web and a second, non-admin account signed in on a
+phone. Both run against the same deployed example-backend.
+
+| ID | Case | Steps | Expected | Platforms | Automated by | Added |
+| --- | --- | --- | --- | --- | --- | --- |
+| ADMIN-001 | An admin edit reaches the owner's phone live | A non-admin user is signed in on a phone with the Todos tab open and one todo titled "Buy milk". On web, an admin opens the Admin Panel, opens that todo, changes its title to "Buy oat milk", and saves | Within 10 seconds, without pulling to refresh or reopening the app, the phone's Todos list shows "Buy oat milk" | iOS, Android | manual | e2e-and-regression-testing |
+| ADMIN-002 | A published announcement shows on a phone | A non-admin user is signed in on a phone. On web, an admin creates and publishes an announcement from the Admin Panel, then the user force quits and reopens the app | The announcement shows once on the phone with the admin's title and body, and does not show again after it is dismissed and the app is reopened | iOS, Android | manual | e2e-and-regression-testing |

package/src/docs/versioned/57.21.0/regression/auth.md

@@ -0,0 +1,15 @@
+# Auth regression suite
+
+Area: AUTH
+Owner: Josh Gachnang
+Last full run: never
+
+Walk these cases against example-frontend and example-backend on a deployed environment whose
+backend sends real email. Use an inbox you can open, not a seeded `@example.com` address.
+
+| ID | Case | Steps | Expected | Platforms | Automated by | Added |
+| --- | --- | --- | --- | --- | --- | --- |
+| AUTH-001 | Password reset email reaches a real inbox | Signed out, with an account whose email is a real inbox you can open: on the login screen tap the forgot-password link, enter that email, tap "Send reset link", open the email, follow its link, enter a new password, tap "Save new password", then sign in with the new password | One reset email arrives within 2 minutes from the configured sender. Its link opens the "Reset password" screen in the app. Sign-in with the new password lands on Todos, and sign-in with the old password shows an error | Web, iOS, Android | manual | e2e-and-regression-testing |
+| AUTH-002 | Verification email confirms the account | Signed in as a new account with a real inbox that has not verified its email: open Profile, tap "Resend" on the verify-email banner, open the email, follow its link, tap "Confirm email", then reopen Profile | One verification email arrives within 2 minutes. After confirming, Profile no longer shows the "Verify your email" banner | Web, iOS, Android | manual | e2e-and-regression-testing |
+| AUTH-003 | Session survives a force quit on a device | Signed in on a release build on a phone, with at least one todo: force quit the app from the app switcher, wait 10 seconds, then open it again | The app opens on Todos with the same todos and no login screen, because the session is read back from the device's secure storage | iOS, Android | manual | e2e-and-regression-testing |
+| AUTH-004 | Logout clears the stored session on a device | Signed in on a release build on a phone: open Profile, tap "Logout", force quit the app, then open it again | The app opens on the login screen, and no data from the previous account shows before sign-in | iOS, Android | manual | e2e-and-regression-testing |

package/src/docs/versioned/57.21.0/regression/planning.md

@@ -0,0 +1,16 @@
+# Planning regression suite
+
+Area: PLAN
+Owner: Josh Gachnang
+Last full run: never
+
+Every case here is retired: they checked agent behavior, not the app, which the minimal
+regression rule leaves out. The rows stay so their IDs are never reused.
+
+| ID | Case | Steps | Expected | Platforms | Automated by | Added |
+| --- | --- | --- | --- | --- | --- | --- |
+| PLAN-001 | Grow plans e2e and regression | In a fresh session in a repo that has `docs/testing/e2e.md`, run Grow on "add a due date to todos" and approve it | Retired: an agent-behavior check, not an app check | Claude Code, Cursor, Codex | manual | e2e-and-regression-testing |
+| PLAN-002 | Grow without a guide | Repeat PLAN-001 in a repo with no `docs/testing/e2e.md` and no Testing conventions table | Retired: an agent-behavior check, not an app check | Claude Code | manual | e2e-and-regression-testing |
+| PLAN-003 | Brew writes the suite | Take an approved IP with one regression case through Brew | Retired: an agent-behavior check, not an app check | Claude Code | manual | e2e-and-regression-testing |
+| PLAN-004 | Pick writes, Roast enforces a planned spec | Run Pick on a PLAN-001 task that owns an `## E2E tests` row. Then delete the spec file and run Roast | Retired: an agent-behavior check, not an app check | Claude Code | manual | e2e-and-regression-testing |
+| PLAN-005 | Taste renumbers a collision | On a branch that added `AUTH-00N`, merge a master commit that also added `AUTH-00N`, then run Taste | Retired: an agent-behavior check, not an app check | Claude Code | manual | e2e-and-regression-testing |

package/src/docs/versioned/57.21.0/regression/syncdb.md

@@ -0,0 +1,15 @@
+# SyncDB regression suite
+
+Area: SYNC
+Owner: Josh Gachnang
+Last full run: never
+
+Walk these cases on a release build on a physical phone, against a deployed example-backend.
+Turn the network off with airplane mode, not by stopping the backend, so the operating system
+reports the device as offline.
+
+| ID | Case | Steps | Expected | Platforms | Automated by | Added |
+| --- | --- | --- | --- | --- | --- | --- |
+| SYNC-001 | An offline edit replays after airplane mode | Signed in on a phone with the Todos tab open and one todo, and the same account open on web: turn on airplane mode, mark the todo complete, wait 30 seconds, then turn airplane mode off | The phone shows the todo complete at once while offline. Within 10 seconds of reconnecting, web shows it complete without a reload, and the phone shows no conflict | iOS, Android | manual | e2e-and-regression-testing |
+| SYNC-002 | An offline create survives a force quit | Signed in on a phone in airplane mode: create a todo titled "Offline note", force quit the app, reopen it still in airplane mode, then turn airplane mode off | After reopening offline the list still shows "Offline note". After reconnecting it appears on web for the same account within 10 seconds, exactly once | iOS, Android | manual | e2e-and-regression-testing |
+| SYNC-003 | Switching accounts on one phone leaks no rows | Signed in on a phone as user A with at least two todos: open Profile, tap "Logout", then sign in as user B, who has no todos | User B's Todos tab is empty, both before and after the first sync completes. None of user A's todos appear at any point | iOS, Android | manual | e2e-and-regression-testing |

package/src/docs/versioned/57.21.0/regression/ui-native.md

@@ -0,0 +1,16 @@
+# Native UI regression suite
+
+Area: NATIVE
+Owner: Josh Gachnang
+Last full run: never
+
+Walk these cases on a fresh install on a physical phone. Delete the app first so the operating
+system asks for each permission again. NATIVE-001 and NATIVE-002 need a development build,
+because Profile shows "Send test push" only in development builds; the others run on either.
+
+| ID | Case | Steps | Expected | Platforms | Automated by | Added |
+| --- | --- | --- | --- | --- | --- | --- |
+| NATIVE-001 | Allowing notifications enables push | On a fresh install of a development build, sign in, tap Allow on the system notification prompt, open Profile, tap "Send test push", then lock the phone | The system prompt appears once, right after sign-in. A test notification shows on the lock screen within 1 minute | iOS, Android | manual | e2e-and-regression-testing |
+| NATIVE-002 | Denying notifications registers no device | On a fresh install of a development build, sign in as an account with no other signed-in devices, tap Don't Allow on the system notification prompt, then open Profile and tap "Send test push" | The app keeps working on Todos. Profile shows "No registered push tokens for this account." under the push button, and the prompt does not reappear on the next launch | iOS, Android | manual | e2e-and-regression-testing |
+| NATIVE-003 | A consent signature can be drawn with a finger | On a fresh install, sign in as an account that has never accepted the consent forms. On each consent screen that asks for a signature, draw a signature with one finger, then accept every form | The stroke follows the finger and the screen does not scroll while drawing. After the last form the app opens on Todos, and after a force quit and reopen no consent screen shows again | iOS, Android | manual | e2e-and-regression-testing |
+| NATIVE-004 | The keyboard does not cover a focused field | Signed in on a phone in portrait: open Profile, scroll to the "API Key" field in the Gemini API Key card, and tap it | The keyboard opens and the focused field stays visible above it, with its "API Key" label on screen | iOS, Android | manual | e2e-and-regression-testing |

package/src/docs/versioned/57.21.0/scans/reduce-cold-compile-time/charter.md

@@ -0,0 +1,129 @@
+# Scan charter — reduce cold `bun run compile` wall-clock time
+
+- Slug: reduce-cold-compile-time
+- Status: approved (2026-09-20)
+- Owner: joshgachnang
+
+## Goal
+
+The terreno monorepo compiles with per-package standalone `tsc` and no build
+cache, TS project references, or shared-dep deduplication. A full cold
+`bun run compile` currently takes ~305s, and the pipeline recompiles shared
+packages (`@terreno/test`, `@terreno/api`, `@terreno/syncdb`, `@terreno/jobs`)
+multiple times per run. This campaign cuts cold compile wall-clock by 30% by
+removing redundant tsc passes, deduplicating shared-dependency recompiles,
+introducing project references, and trimming non-typecheck work from the compile
+path — without changing published dist output or weakening type-safety. Faster
+compiles shorten every bootstrap, CI run, and agent iteration.
+
+## Metric
+
+| Field | Value |
+| --- | --- |
+| Name | Cold full-monorepo compile wall-clock |
+| Command | `find . -maxdepth 2 -name '*.tsbuildinfo' -not -path '*/node_modules/*' -delete; rm -rf */dist; time bun run compile` (min of 3 runs, seconds) |
+| Unit | s |
+| Direction | down |
+| Protocol | Cold (dist + tsbuildinfo removed before each run), best (min) of 3 consecutive runs, same VM |
+| Baseline | 305 (measured 2026-09-20) |
+| Target | 214 |
+| Horizon | 4 rounds |
+
+Baseline evidence:
+
+```text
+run1 exit=0 elapsed=321s
+run2 exit=0 elapsed=305s
+run3 exit=0 elapsed=309s
+# best of 3 = 305s ; target -30% = 214s
+```
+
+## Scope
+
+- In scope: build/compile configuration only — root `package.json` compile
+  scripts, per-package `tsconfig.json` / `tsconfig.server.json`,
+  `.github/scripts/compile-workspace-deps.js`, per-package `compile` scripts,
+  and any new build tooling that measurably reduces cold compile time.
+- Out of scope: product/source logic, test assertions, runtime behavior,
+  dependency version bumps unrelated to the build.
+- Unacceptable trade-offs:
+  - **Published dist output must stay intact** — `declaration` (.d.ts) emit and
+    the published `dist/` layout for every `@terreno/*` package are preserved.
+  - **No type-safety loss** — no loosening `strict`/`strictNullChecks`, no
+    removing existing `skipLibCheck`, no `noEmit`-to-skip-checks tricks. Adding
+    `skipLibCheck` where absent is allowed.
+  - Publish-time behavior of `compile-workspace-deps.js` must be preserved
+    (it exists because tag-publish replaces `workspace:*` refs before install).
+
+New build dependencies ARE permitted (owner did not exclude them), provided the
+two guardrails above hold.
+
+## Detection rules
+
+| Rule | Query | Matches | Why it moves the metric | Hits |
+| --- | --- | --- | --- | --- |
+| redundant-pipeline | Inspect root `compile` script; `grep -rl compile-workspace-deps */package.json` | Root `compile` runs `@terreno/test` and `@terreno/api` explicitly, then `--filter '*'` recompiles them again; `api` and `admin-backend` re-`tsc` shared deps via `compile-workspace-deps.js` | Every duplicate tsc pass of a large package (api=90k LOC, syncdb, test) is pure cold-time waste | 4 |
+| no-project-references | For each compile-path tsconfig: `grep -L '"references"'`; check for a root solution tsconfig | 19 tsconfigs compile as isolated `tsc` with no `references`; no root solution tsconfig | Project references (`tsc -b`) compile each package once in dep order and enable parallelism, killing recompile overlap | 19 |
+| non-typecheck-work-in-compile | `grep -E 'sync-\|cp \|&&.*&&'` in each package `compile` script | `mcp-server` runs 3 doc-sync scripts at 8GB heap plus a `cp` before/around its `tsc` on every compile | Non-tsc work on the compile critical path adds fixed cold-time cost unrelated to type-checking | 1 |
+| missing-skiplibcheck | For each compile-participating tsconfig: `grep '"skipLibCheck"'` | `demo/tsconfig.json` and `website/tsconfig.json` lack `skipLibCheck` (their compile scripts use these configs) | Without `skipLibCheck`, tsc type-checks every `.d.ts` in the dependency tree — costly for RN/Expo/docs dep trees | 2 |
+
+## Exclusions
+
+Beyond the map-reduce defaults: `node_modules/`, `*/dist/`, `patches/`,
+`terraform/`, generated files (`openApiSdk.ts`, `plugins/terreno-claude/`), and
+`example-frontend` (no `compile` script — not on the compile path).
+
+## Validity rule
+
+A finding is valid only when applying it measurably reduces cold `bun run compile`
+wall-clock (best-of-3) while keeping published dist output identical and
+type-safety unchanged.
+
+## Severity rubric
+
+| Severity | Threshold |
+| --- | --- |
+| high | Plausibly removes ≥30s of cold compile time |
+| medium | Plausibly removes 5–30s |
+| low | Plausibly removes <5s |
+
+Effort: S = under an hour, M = under a day, L = more than a day or needs design.
+
+## Slice policy
+
+- Maximum 4 files and 3 findings per slice.
+- Never mix: a project-references migration with unrelated tsconfig flag tweaks;
+  or `compile-workspace-deps.js` changes with anything else.
+- Always its own slice: the `tsc -b` / project-references migration (touches
+  every package + CI; reviewer-heavy) and any `compile-workspace-deps.js`
+  change (publish-time behavior risk).
+
+## Review routing
+
+| Field | Value |
+| --- | --- |
+| Mode | fixed |
+| Reviewers | @joshgachnang |
+| Assignee | @joshgachnang |
+| Teams | — |
+| Draft | no |
+| Labels | reduce-cold-compile-time, build-perf |
+| Merge policy | human |
+| Notify | PR body mention |
+
+## Budget
+
+- Rounds: 4
+- Slices per round: 2
+- Open PRs at once (`wipLimit`): 1
+- Minimum metric step per round before reporting diminishing returns: 10s
+
+## Decisions
+
+| Decision | Question that prompted it |
+| --- | --- |
+| Goal = reduce cold `bun run compile` wall-clock | "What goal should this scan campaign drive toward?" |
+| Target = 214s (−30% of 305s baseline) | "How aggressive a cold-compile reduction should this campaign target?" |
+| Guardrails = keep published dist output + no type-safety loss; new build deps allowed | "What must this campaign NOT break while cutting compile time?" |
+| Review = fixed @joshgachnang, human merge | "Who reviews the campaign's PRs, and what's the merge policy?" |
+| Budget = 1 open PR, 2 slices/round, 4 rounds | "How much work-in-progress should the campaign carry per round?" |

package/src/docs/versioned/57.21.0/scans/reduce-cold-compile-time/round-1-findings.md

@@ -0,0 +1,62 @@
+# Round 1 findings — reduce cold `bun run compile` time
+
+- Goal: reduce cold `bun run compile` wall-clock across the terreno monorepo
+- Metric: cold compile seconds (best of 3). **Baseline 305s → target 214s (−30%)**
+- Head: `f8779a96`
+- Kept: 4 findings · Merged: 2 candidates · Dropped: 2 candidates
+
+## Measured evidence (Sift verification)
+
+| Measurement | Result |
+| --- | --- |
+| `@terreno/test` compile (cold) | 10s |
+| `@terreno/api` compile FULL (compile-workspace-deps + tsc, cold) | 50s |
+| `@terreno/api` tsc-only (deps prebuilt) | 31s → compile-workspace-deps adds **~19s per api compile** |
+| demo `tsc --noEmit` without vs with `--skipLibCheck` | 10s vs 10s → **0s** delta |
+| mcp-server sync scripts (sync-ui / sync-versioned / sync-package) | 0s + 5s + 0s = **~5s** |
+
+## Ranked findings
+
+| # | ID | Rule | Sev | Conf | Effort | Est. cold-time saving | Anchors |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| 1 | redundant-explicit-prefix | redundant-pipeline | high | high | S* | ~60s (1× test + 1× api) | `package.json:223` |
+| 2 | compile-workspace-deps-overlap | redundant-pipeline | high | high | M | ~19s+ per api compile, ×2–3 dependents | `.github/scripts/compile-workspace-deps.js:22`, `api/package.json:117`, `admin-backend/package.json:47` |
+| 3 | no-project-references | no-project-references | high | medium | L | large but unquantified; durable fix that enables #1/#2 safely | `api/tsconfig.json:1` + 18 more; no root solution tsconfig |
+| 4 | mcp-doc-sync-on-compile-path | non-typecheck-work-in-compile | medium | high | S | ~5s | `mcp-server/package.json:52` |
+
+\* #1 is a one-line edit but is **load-bearing for build ordering** — safe only once #2/#3 provide dependency-ordered builds. See coupling note below.
+
+## High-severity findings (adversarial verification)
+
+### 1. Redundant explicit `test`+`api` prefixes in root compile — CONFIRMED
+Root `compile` = `bun run --filter '@terreno/test' compile && bun run --filter '@terreno/api' compile && bun run --filter '*' compile`. The final `--filter '*'` already builds all 19 workspaces including `test` and `api`, so the two prefixes are a full extra cold compile of test (10s) + api (50s) = **~60s of duplication**.
+
+*Refutation attempted:* "The prefixes force build order; removing them breaks `*`." → Partially holds. `compile-workspace-deps.js` makes api self-build its deps, so api compiles fine inside `*`; but bun `--filter '*'` gives no guaranteed dependency order, so the prefixes currently serve as a crude ordering hack. Verdict: the **duplication is real and confirmed**, but the safe fix is to introduce real ordering (#2/#3), not to blindly delete the prefixes. Kept high.
+
+### 2. compile-workspace-deps.js re-tsc's shared deps every compile — CONFIRMED
+`compile-workspace-deps.js:22` (`const compiled = new Set()`) dedupes only within one node process. Each package's compile runs in its own `bun run` process, so api re-builds test+syncdb (+19s measured over tsc-only), and admin-backend re-builds api (~50s!)+jobs+test — while `--filter '*'` also builds those same packages as their own targets. Shared deps are cold-compiled multiple times per run.
+
+*Refutation attempted:* "The script is required so deps' `dist` exists before dependents compile." → Holds for the current unordered `*` build, and the script's own doc comment says it exists for tag-publish (post-`workspace:*`-replacement installs). Verdict: confirmed redundant **for the dev/monorepo build**; the fix must preserve publish-time behavior (charter guardrail) and supply ordering another way. Kept high, effort M.
+
+### 3. No TS project references / `tsc -b` solution build — CONFIRMED
+No package tsconfig has `references` or `composite`, and there is no root solution tsconfig (`grep -c '"composite"'` → 0 everywhere; `ls tsconfig.json` → not found). Every package is a full standalone `tsc`.
+
+*Refutation attempted:* "Project references help warm builds (via .tsbuildinfo reuse), not cold — this campaign measures cold." → Fails: even cold, `tsc -b` walks the reference graph and compiles each package **exactly once** in dependency order and parallelizes independent leaves, eliminating the multi-recompile waste that #1 and #2 describe. It is the durable structural fix that makes #1 and #2 safe. Verdict: confirmed high; magnitude unproven without doing the migration → confidence medium, effort L.
+
+## Coupling note (for Plot)
+
+Findings #1, #2, #3 are one problem at three depths: the pipeline recompiles shared packages because there is no dependency-ordered build. #3 (project references) is the durable fix and would subsume #1/#2. A lighter interim fix is bun topological filter ordering. Per charter slice policy: the project-references migration and any `compile-workspace-deps.js` change each get **their own slice**. Finding #4 is fully independent and is the cheapest standalone win.
+
+## Merged candidates
+
+- `s1-pipeline-3` ("test compiled 3×") — folded into #1 and #2; it is the same duplication counted from test's side.
+- `s3-mcpwork-2` ("8GB heap flag on copy scripts") — folded into #4; negligible sub-part of the same compile string.
+
+## Dropped candidates
+
+| Candidate | Reason |
+| --- | --- |
+| `s4-skiplibcheck-1` (demo) | **Invalid — refuted.** `skipLibCheck` is already inherited from `expo/tsconfig.base` (`skipLibCheck: true`). Measured delta 10s vs 10s = 0s. No metric movement. |
+| `s4-skiplibcheck-2` (website) | **Invalid — refuted.** `skipLibCheck` already inherited from `@docusaurus/tsconfig` (`skipLibCheck: true`). `--noEmit` + tiny source set → no measurable movement. |
+
+Drop reasons: 2/2 = already-satisfied-via-inheritance / no-metric-movement.

package/src/docs/versioned/57.21.0/tasks/README.md

@@ -0,0 +1,53 @@
+# Task lists
+
+Bot-consumable execution checklists. Most files pair with an implementation plan (IP)
+as described in [`docs/implementationPlans/README.md`](../implementationPlans/README.md):
+
+- **IP** (`docs/implementationPlans/<slug>.md`) — the design: what and why.
+- **Task list** (`docs/tasks/<slug>.md`) — the steps: the concrete, ordered work.
+
+The filename slug matches the IP it belongs to.
+
+The loop's small-feature profile may use a task file with `**Feature profile:** true` and
+no full IP when repository policy permits. The destination, scope, decisions, acceptance
+criteria, tracer, and verification seam live in that durable contract so Pick can
+implement one task, roast it, and continue to the next without conversation history.
+
+## Task shape
+
+Each task is a tracer-bullet vertical slice with explicit blocking edges:
+
+```markdown
+- [ ] **Task 1.1**: Short title
+  - Delivers: the narrow end-to-end behavior this makes usable
+  - Files: expected files to create or modify
+  - Blocked by: none | other task IDs
+  - Acceptance: observable proof, including focused Bun tests
+```
+
+Group tasks by phase (`### Phase 1: …`) and order them by dependency. Every normal task
+cuts through the required data, API, UI, documentation, and test layers rather than
+batching one layer across the whole feature. A completed task is demoable or independently
+verifiable and small enough for one fresh agent context. Work the **frontier**: any task
+whose blockers are complete.
+
+Wide mechanical refactors that cannot land green as vertical slices use
+**expand → migrate batches → contract**. The contract task is blocked by every migration
+batch. Grow-style runs may append a **Plan vs Actual** log after each task.
+
+## What lives here vs elsewhere
+
+| Concern | Home |
+| ------- | ---- |
+| Design, scope, acceptance criteria | the IP (`docs/implementationPlans/`) |
+| Concrete task steps and their status | this directory |
+| Public status and target | GitHub roadmap issue / Project (roadmap-enabled repos) |
+| Sprint estimates and assignees | Linear |
+| Current stage/attempt/head/result | loop-owned execution state (default `.terreno/pipeline/<slug>.json`) |
+
+Do not copy the full checklist into a GitHub issue or Linear. Create linked GitHub child
+issues only for tasks that outside contributors should be able to claim independently; the
+task file stays the source of truth for scope and acceptance.
+
+The docs site excludes this directory, so link to task files with full GitHub URLs from
+pages that render on the site.

package/src/docs/versioned/57.21.0/tasks/admin-scripts-durable-jobs.md

@@ -0,0 +1,10 @@
+# Tasks: Admin scripts via durable jobs
+
+**IP:** [admin-scripts-durable-jobs.md](../implementationPlans/admin-scripts-durable-jobs.md)
+
+- [x] **Task 1**: `admin/script` adapter (`defineAdminScriptJob`, payload parse, dual-write `BackgroundTask`)
+- [x] **Task 2**: `AdminApp` enqueue/cancel when `JobsApp` is registered; in-process fallback
+- [x] **Task 3**: example-backend worker + API share `defineAdminScriptJob(adminScripts)`
+- [x] **Task 4**: Docs (how-to jobs, jobs reference, admin-backend scripts)
+- [x] **Task 5**: Example GCP runtime selects `GcpCloudTasksRunner` and verifies callback OIDC
+- [x] **Task 6**: CD supplies `JOBS_RUNNER=gcp-cloud-tasks` and per-PR callback URLs