@terreno/mcp 57.3.0 → 57.6.0

package/src/docs/versioned/57.2.0/reference/components/table-icon-button.mdx

@@ -14,7 +14,7 @@ The table icon button is an interactive element that allows the user to edit rec
 **Package:** `@terreno/ui`  
 **Categories:** Component  
 **Props interface:** `TableIconButtonProps`  
-**Story source:** [`demo/stories/Tableiconbutton.stories.tsx`](https://github.com/flourishhealth/terreno/blob/master/demo/stories/Tableiconbutton.stories.tsx)
+**Story source:** [`demo/stories/Tableiconbutton.stories.tsx`](https://github.com/TerrenoLabs/terreno/blob/master/demo/stories/Tableiconbutton.stories.tsx)
 
 ## Live demo
 

package/src/docs/versioned/57.2.0/reference/components/table-number.mdx

@@ -14,7 +14,7 @@ Use this component to display a number on the table that’s NOT a date or a cur
 **Package:** `@terreno/ui`  
 **Categories:** Component  
 **Props interface:** `TableNumberProps`  
-**Story source:** [`demo/stories/Tablenumber.stories.tsx`](https://github.com/flourishhealth/terreno/blob/master/demo/stories/Tablenumber.stories.tsx)
+**Story source:** [`demo/stories/Tablenumber.stories.tsx`](https://github.com/TerrenoLabs/terreno/blob/master/demo/stories/Tablenumber.stories.tsx)
 
 ## Live demo
 

package/src/docs/versioned/57.2.0/reference/components/table-text.mdx

@@ -14,7 +14,7 @@ This component adds a single line of text to the table.
 **Package:** `@terreno/ui`  
 **Categories:** Component  
 **Props interface:** `TableTextProps`  
-**Story source:** [`demo/stories/TableText.stories.tsx`](https://github.com/flourishhealth/terreno/blob/master/demo/stories/TableText.stories.tsx)
+**Story source:** [`demo/stories/TableText.stories.tsx`](https://github.com/TerrenoLabs/terreno/blob/master/demo/stories/TableText.stories.tsx)
 
 ## Live demo
 

package/src/docs/versioned/57.2.0/reference/components/table-title.mdx

@@ -14,7 +14,7 @@ This component populates the titles for each table column. They’re ordered by
 **Package:** `@terreno/ui`  
 **Categories:** Component  
 **Props interface:** `TableTitleProps`  
-**Story source:** [`demo/stories/Tabletitle.stories.tsx`](https://github.com/flourishhealth/terreno/blob/master/demo/stories/Tabletitle.stories.tsx)
+**Story source:** [`demo/stories/Tabletitle.stories.tsx`](https://github.com/TerrenoLabs/terreno/blob/master/demo/stories/Tabletitle.stories.tsx)
 
 ## Live demo
 

package/src/docs/versioned/57.2.0/reference/components/table.mdx

@@ -14,7 +14,7 @@ In this case, Table is a pattern, not a component. Build a table by sorting the
 **Package:** `@terreno/ui`  
 **Categories:** Pattern  
 **Props interface:** `TableProps`  
-**Story source:** [`demo/stories/Table.stories.tsx`](https://github.com/flourishhealth/terreno/blob/master/demo/stories/Table.stories.tsx)
+**Story source:** [`demo/stories/Table.stories.tsx`](https://github.com/TerrenoLabs/terreno/blob/master/demo/stories/Table.stories.tsx)
 
 ## Live demo
 

package/src/docs/versioned/57.2.0/reference/components/tap-to-edit.mdx

@@ -14,7 +14,7 @@ This element allows the user to see information and interact with an icon to edi
 **Package:** `@terreno/ui`  
 **Categories:** Component  
 **Props interface:** `TapToEditProps`  
-**Story source:** [`demo/stories/Taptoedit.stories.tsx`](https://github.com/flourishhealth/terreno/blob/master/demo/stories/Taptoedit.stories.tsx)
+**Story source:** [`demo/stories/Taptoedit.stories.tsx`](https://github.com/TerrenoLabs/terreno/blob/master/demo/stories/Taptoedit.stories.tsx)
 
 ## Live demo
 

package/src/docs/versioned/57.2.0/reference/components/text-area.mdx

@@ -14,7 +14,7 @@ Use the text area form field to allow the user to enter multiple lines of text.
 **Package:** `@terreno/ui`  
 **Categories:** Component  
 **Props interface:** `TextAreaProps`  
-**Story source:** [`demo/stories/Textarea.stories.tsx`](https://github.com/flourishhealth/terreno/blob/master/demo/stories/Textarea.stories.tsx)
+**Story source:** [`demo/stories/Textarea.stories.tsx`](https://github.com/TerrenoLabs/terreno/blob/master/demo/stories/Textarea.stories.tsx)
 
 ## Live demo
 

package/src/docs/versioned/57.2.0/reference/components/text-field.mdx

@@ -14,7 +14,7 @@ Use the text field to allow a user to input a single line of text.
 **Package:** `@terreno/ui`  
 **Categories:** Component  
 **Props interface:** `TextFieldProps`  
-**Story source:** [`demo/stories/Textfield.stories.tsx`](https://github.com/flourishhealth/terreno/blob/master/demo/stories/Textfield.stories.tsx)
+**Story source:** [`demo/stories/Textfield.stories.tsx`](https://github.com/TerrenoLabs/terreno/blob/master/demo/stories/Textfield.stories.tsx)
 
 ## Live demo
 

package/src/docs/versioned/57.2.0/reference/components/theme.mdx

@@ -14,7 +14,7 @@ Theme
 **Package:** `@terreno/ui`  
 **Categories:** Foundation  
 **Props interface:** `ThemeProps`  
-**Story source:** [`demo/stories/Theme.stories.tsx`](https://github.com/flourishhealth/terreno/blob/master/demo/stories/Theme.stories.tsx)
+**Story source:** [`demo/stories/Theme.stories.tsx`](https://github.com/TerrenoLabs/terreno/blob/master/demo/stories/Theme.stories.tsx)
 
 ## Live demo
 

package/src/docs/versioned/57.2.0/reference/components/thumbsupdownfeedback.mdx

@@ -14,7 +14,7 @@ ThumbsUpDownFeedback is a thumbs up / thumbs down pair for collecting a single p
 **Package:** `@terreno/ui`  
 **Categories:** Component  
 **Props interface:** `ThumbsUpDownFeedbackProps`  
-**Story source:** [`demo/stories/ThumbsUpDownFeedback.stories.tsx`](https://github.com/flourishhealth/terreno/blob/master/demo/stories/ThumbsUpDownFeedback.stories.tsx)
+**Story source:** [`demo/stories/ThumbsUpDownFeedback.stories.tsx`](https://github.com/TerrenoLabs/terreno/blob/master/demo/stories/ThumbsUpDownFeedback.stories.tsx)
 
 ## Live demo
 

package/src/docs/versioned/57.2.0/reference/components/toast.mdx

@@ -14,7 +14,7 @@ Toasts are brief and small messages that overlay content, but do not block the u
 **Package:** `@terreno/ui`  
 **Categories:** Component  
 **Props interface:** `ToasterProps`  
-**Story source:** [`demo/stories/Toast.stories.tsx`](https://github.com/flourishhealth/terreno/blob/master/demo/stories/Toast.stories.tsx)
+**Story source:** [`demo/stories/Toast.stories.tsx`](https://github.com/TerrenoLabs/terreno/blob/master/demo/stories/Toast.stories.tsx)
 
 ## Live demo
 

package/src/docs/versioned/57.2.0/reference/components/tooltip.mdx

@@ -14,7 +14,7 @@ Tooltip is a floating text label that succinctly describes the function of an in
 **Package:** `@terreno/ui`  
 **Categories:** Component  
 **Props interface:** `TooltipProps`  
-**Story source:** [`demo/stories/Tooltip.stories.tsx`](https://github.com/flourishhealth/terreno/blob/master/demo/stories/Tooltip.stories.tsx)
+**Story source:** [`demo/stories/Tooltip.stories.tsx`](https://github.com/TerrenoLabs/terreno/blob/master/demo/stories/Tooltip.stories.tsx)
 
 ## Live demo
 

package/src/docs/versioned/57.2.0/reference/components/typed-signature-field.mdx

@@ -14,7 +14,7 @@ Lets a user type their name and choose a signature font with a live preview. Wor
 **Package:** `@terreno/ui`  
 **Categories:** Component  
 **Props interface:** `TypedSignatureFieldProps`  
-**Story source:** [`demo/stories/Typedsignaturefield.stories.tsx`](https://github.com/flourishhealth/terreno/blob/master/demo/stories/Typedsignaturefield.stories.tsx)
+**Story source:** [`demo/stories/Typedsignaturefield.stories.tsx`](https://github.com/TerrenoLabs/terreno/blob/master/demo/stories/Typedsignaturefield.stories.tsx)
 
 ## Live demo
 

package/src/docs/versioned/57.2.0/reference/components/userinactivity.mdx

@@ -14,7 +14,7 @@ A component that detects user inactivity by monitoring touch events and keyboard
 **Package:** `@terreno/ui`  
 **Categories:** Component  
 **Props interface:** `UserInactivityProps`  
-**Story source:** [`demo/stories/UserInactivity.stories.tsx`](https://github.com/flourishhealth/terreno/blob/master/demo/stories/UserInactivity.stories.tsx)
+**Story source:** [`demo/stories/UserInactivity.stories.tsx`](https://github.com/TerrenoLabs/terreno/blob/master/demo/stories/UserInactivity.stories.tsx)
 
 ## Live demo
 

package/src/docs/versioned/57.2.0/reference/environment-variables.md

@@ -231,8 +231,8 @@ Sender identity must be verified in SendGrid before real delivery works.
 
 ## Example `.env` files
 
-- [`example-backend/.env.example`](https://github.com/FlourishHealth/terreno/blob/master/example-backend/.env.example)
-- [`example-frontend/.env.example`](https://github.com/FlourishHealth/terreno/blob/master/example-frontend/.env.example)
+- [`example-backend/.env.example`](https://github.com/TerrenoLabs/terreno/blob/master/example-backend/.env.example)
+- [`example-frontend/.env.example`](https://github.com/TerrenoLabs/terreno/blob/master/example-frontend/.env.example)
 
 ## Related documentation
 

package/src/docs/versioned/57.2.0/reference/lifecycle-plugin.md

@@ -24,9 +24,9 @@ Every stage includes:
 - Recommended next stage
 
 Results use `PASS`, `FAIL`, `BLOCKED`, or `PENDING` and the compact `v: 2` schema
-[`stage-result.schema.json`](https://github.com/FlourishHealth/terreno/blob/master/plugins/terreno-planning/references/stage-result.schema.json)
+[`stage-result.schema.json`](https://github.com/TerrenoLabs/terreno/blob/master/plugins/terreno-planning/references/stage-result.schema.json)
 (`v`, `stage`, `status`, `next`, `action`; omit empty keys). Loop state follows
-[`execution-state.schema.json`](https://github.com/FlourishHealth/terreno/blob/master/plugins/terreno-planning/references/execution-state.schema.json).
+[`execution-state.schema.json`](https://github.com/TerrenoLabs/terreno/blob/master/plugins/terreno-planning/references/execution-state.schema.json).
 Chat and PRs show `status` / `next` / `action`; the YAML lives in a Details toggle.
 
 The outer loop owns state persistence, waiting, stage invocation, retries, and escalation.
@@ -37,14 +37,14 @@ GitHub communication follows a fixed attention budget: `Why`, `What changed`, an
 are reserved for blocked decisions or non-obvious review resolutions.
 
 Every stage follows the
-[documentation contract](https://github.com/FlourishHealth/terreno/blob/master/plugins/terreno-planning/references/documentation-contract.md):
+[documentation contract](https://github.com/TerrenoLabs/terreno/blob/master/plugins/terreno-planning/references/documentation-contract.md):
 read architecture docs before acting, update them in the same slice, and fail the slice
 when user-visible or architectural behavior ships without matching docs.
 
 Install the published skill set (lifecycle stages plus repo and package skills):
 
 ```bash
-npx skills add FlourishHealth/terreno
+npx skills add TerrenoLabs/terreno
 ```
 
 Regenerate the committed `skills/` tree with `bun run skills:sync`. Package skills under

package/src/docs/versioned/57.2.0/reference/ui.md

@@ -402,7 +402,7 @@ declare module "@terreno/ui" {
 }
 ``````
 
-See [`demo/components/customIcons.tsx`](https://github.com/flourishhealth/terreno/blob/master/demo/components/customIcons.tsx) for a full working example.
+See [`demo/components/customIcons.tsx`](https://github.com/TerrenoLabs/terreno/blob/master/demo/components/customIcons.tsx) for a full working example.
 
 ### Built-in Status Icons
 

package/src/docs/versioned/57.2.0/roadmap.md

@@ -2,8 +2,8 @@
 
 Terreno's public roadmap lives on GitHub:
 
-- **[ROADMAP.md](https://github.com/FlourishHealth/terreno/blob/master/ROADMAP.md)** — generated from the Terreno Roadmap project board (also in the repo root)
+- **[ROADMAP.md](https://github.com/TerrenoLabs/terreno/blob/master/ROADMAP.md)** — generated from the Terreno Roadmap project board (also in the repo root)
 - **[Roadmap process](explanation/roadmap-process.md)** — Discussions, triage, Linear bridge, maintainer setup
-- **[GitHub Discussions](https://github.com/FlourishHealth/terreno/discussions)** — Ideas, Q&A, RFCs
+- **[GitHub Discussions](https://github.com/TerrenoLabs/terreno/discussions)** — Ideas, Q&A, RFCs
 
-To propose work, start an [Ideas discussion](https://github.com/FlourishHealth/terreno/discussions/new?category=ideas) rather than opening a tracking issue directly.
+To propose work, start an [Ideas discussion](https://github.com/TerrenoLabs/terreno/discussions/new?category=ideas) rather than opening a tracking issue directly.

package/src/docs/versioned/57.2.0/tasks/docs-reference-coverage.md

@@ -8,7 +8,7 @@ See: [`docs/implementationPlans/docs-reference-coverage.md`](../implementationPl
 
 - **Do not write documentation from scratch.** The content already exists in `.cursor/rules/*/00-*.mdc` files. Your job is to convert prescriptive agent rules into descriptive public reference prose, verify every claim against source, and remove anything internal.
 - Verify every exported symbol you document by grepping the package's `src/index.ts`. If a rule file documents something that no longer exists, drop it and note the drift in the PR body.
-- READMEs are rendered on npmjs.com where relative links break. Use absolute `https://github.com/flourishhealth/terreno/...` or docs-site URLs in every README.
+- READMEs are rendered on npmjs.com where relative links break. Use absolute `https://github.com/TerrenoLabs/terreno/...` or docs-site URLs in every README.
 - Match the section ordering of `docs/reference/api.md` for new reference pages. Read it first.
 - Run `bun run website:build` before each commit that adds or moves a docs page.
 

package/src/docs/versioned/57.2.0/tasks/migrate-cicd-to-circleci.md

@@ -15,7 +15,7 @@ Research: [`docs/implementationPlans/migrate-cicd-to-circleci-research.md`](../i
 ## Phase 0: Prerequisites
 
 - [ ] **Task 0.1**: Confirm CircleCI org/plan and project link
-  - Description: Verify the requester-created CircleCI organization, plan, and that `FlourishHealth/terreno` is connected with permission to report GitHub checks. Enable **dynamic config** / setup workflows for the project. Record org slug + project slug in the IP header or how-to doc.
+  - Description: Verify the requester-created CircleCI organization, plan, and that `TerrenoLabs/terreno` is connected with permission to report GitHub checks. Enable **dynamic config** / setup workflows for the project. Record org slug + project slug in the IP header or how-to doc.
   - Files: `docs/how-to/circleci.md` (stub OK)
   - Depends on: none (human prerequisite)
   - Acceptance: a manual “hello” pipeline can be triggered from the project; dynamic config is enabled.

package/src/docs/versioned/57.2.0/tasks/web-ssr-and-admin-spa.md

@@ -4,7 +4,7 @@ See: [`docs/implementationPlans/web-ssr-and-admin-spa.md`](../implementationPlan
 
 **RTK deprecation flag:** **Partial.** Phase 0 must run after PR #869 merges, because whether the local-first client can be kept out of the server render path is the main feasibility question. Tasks marked `[RTK]` touch the data layer directly.
 
-**Prerequisite:** Expo SDK ≥ 55. The repo catalog is on `~54.0.29`; PR [#779](https://github.com/flourishhealth/terreno/pull/779) upgrades to SDK 56. Verify the merged Expo version before starting and stop if it is below 55.
+**Prerequisite:** Expo SDK ≥ 55. The repo catalog is on `~54.0.29`; PR [#779](https://github.com/TerrenoLabs/terreno/pull/779) upgrades to SDK 56. Verify the merged Expo version before starting and stop if it is below 55.
 
 ## Instructions for the implementing agent
 

package/src/docs/versioned/next/README.md

@@ -41,9 +41,12 @@ Canonical copy, language rules, and the Django/Rails comparison:
 | [@terreno/admin-frontend](reference/admin-frontend.md) | Admin panel frontend screens for `@terreno/api` backends |
 | [@terreno/admin-spa](reference/admin-spa.md) | Standalone admin SPA (Expo Router web) plus Express serve plugin |
 | [@terreno/api-health](reference/api-health.md) | Health check plugin for `@terreno/api` |
+| [@terreno/announcements](reference/announcements.md) | In-app product update announcements |
 | [@terreno/comms](reference/comms.md) | Pluggable communications providers |
 | [@terreno/feature-flags](reference/feature-flags.md) | Feature flags and A/B testing plugin for `@terreno/api` |
 | [@terreno/mcp](reference/mcp-server.md) | MCP server that gives coding agents Terreno docs, codegen tools, and prompts |
+| [@terreno/cli](reference/cli.md) | `terreno` CLI for docs, codegen, bootstrap, and OpenAPI REST |
+| [create-terreno-app](reference/create-terreno-app.md) | CLI to scaffold a deployable full-stack Terreno app (`bunx create-terreno-app`) |
 
 ### Legacy
 
@@ -56,6 +59,9 @@ Canonical copy, language rules, and the Django/Rails comparison:
 ## Quick links
 
 - [Getting started](tutorials/getting-started.md)
+- [Set up Terreno MCP](how-to/set-up-terreno-mcp.md)
+- [Debug with MCP](how-to/debug-with-mcp.md)
+- [Create a Terreno app](how-to/create-a-terreno-app.md)
 - [Positioning](explanation/positioning.md)
 - [How admin interfaces are shaped](explanation/admin-interface.md)
 - [Build admin screens](how-to/build-admin-screens.md)

package/src/docs/versioned/next/explanation/README.md

@@ -11,17 +11,20 @@ Understanding-oriented documentation: concepts, architecture, and context.
 ## Contents
 
 - [Local-first data](local-first-data.md) — Why the local store is the UI source of truth
+- [Planning plugins](planning-plugins.md) — How the lifecycle and scan plugins divide discovery from delivery
 - [Loop engineering](loop-engineering.md) — Fresh-invocation lifecycle, state, evidence, and orchestration boundaries
 - [GitHub issue lifecycle](../how-to/github-issue-lifecycle.md) — Pick-ready issues and plan comments for Pick/Roast
-- [Install agent skills](../how-to/install-agent-skills.md) — `npx skills add FlourishHealth/terreno`
+- [Install agent skills](../how-to/install-agent-skills.md) — `npx skills add TerrenoLabs/terreno`
 - [AI-powered workflows](ai-workflows.md) — Autonomous documentation, testing, and maintenance workflows
 - [Authentication architecture](authentication.md) — Better Auth, JWT, and optional MCP service tokens
+- [Organization tenancy](organizations.md) — Optional Membership-backed tenancy, context, and isolation boundaries
 - [Configuration system](configuration-system.md) — Runtime configuration with database persistence
 - [Dependency management](dependency-management.md) — Catalog pins, exercise tests, fingerprint freeze
 - [Modular API design](modular-api-design.md) — 🚧 Why TerrenoApp replaces setupServer
 - [modelRouter actions](model-router-actions.md) — Named collection and instance operations on modelRouter
 - [Explicit `any` policy](explicit-any-policy.md) — Require rationale markers and ratchet usage per file
 - [No barrel imports](no-barrel-imports.md) — Import concrete modules, not `index` re-export barrels
+- [TypeScript configuration](typescript-configuration.md) — tsconfig profiles for Node, frontend, Expo, and Bun workspaces on TypeScript 6
 - [Production source rules](source-rules.md) — Arrow functions, Luxon, APIError, logging, findOne, `as any`
 - [Positioning](positioning.md) — Canonical copy blocks and the honest Django/Rails comparison
 - [Versioning policy](versioning-policy.md) — Lockstep `@terreno/*` versions, pre-1.0 breaks, deprecation window
@@ -29,5 +32,6 @@ Understanding-oriented documentation: concepts, architecture, and context.
 - [Admin plugin frontend widgets](admin-plugin-frontend.md) — Widget IDs from backend plugins
 - [Consent admin migration](admin-consent-migration.md) — Which consent screens stay hand-written
 - [Public roadmap process](roadmap-process.md) — GitHub roadmap vs Linear execution
+- [Example app coverage](example-coverage.md) — Which framework capabilities the example apps exercise
 - [Repository settings](repository-settings.md) — Maintainer GitHub settings that cannot be committed
-- [Roadmap seed issues](roadmap-seed-issues.md) — Ready-to-paste GitHub issue bodies for IPs
+- [Why Terreno owns chart SVG](charts.md) — Owned `react-native-svg` vs victory-native

package/src/docs/versioned/next/explanation/admin-interface.md

@@ -12,22 +12,25 @@ workflow (consent publish, comms message detail, password-on-create).
 
 ## Two hosts
 
-| Host | When to use | Route prefix (`routeBase`) | API prefix (`apiBase`) |
-| --- | --- | --- | --- |
-| Embedded (`example-frontend/app/admin`) | Admin lives inside the product Expo app | `"/admin"` | `"/admin"` |
-| Standalone (`@terreno/admin-spa`) | Same-origin console served by `AdminSpaServeApp` | `""` (SPA root; mount is `/console`) | `"/admin"` |
+| Host | When to use | Route prefix (`routeBase`) | API prefix (`apiBase`) | Fetch auth |
+| --- | --- | --- | --- | --- |
+| Embedded (`example-frontend/app/admin`) | Admin lives inside the product Expo app | `"/admin"` | `"/admin"` | `getAuthHeaders` → Bearer, plus `apiOrigin` = RTK `baseUrl` so RPC does not hit the Expo origin |
+| Standalone (`@terreno/admin-spa`) | Same-origin console served by `AdminSpaServeApp` | `""` (SPA root; mount is `/console`) | `"/admin"` | `credentials="same-origin"`; empty `getAuthHeaders`; omit `apiOrigin` |
 
 `apiBase` is the HTTP path for `/config` and CRUD. `routeBase` is the Expo Router
 prefix the sidebar concatenates onto `/{model.name}` and `/{screen.name}`. Mixing
-them puts nav on the wrong URL.
+them puts nav on the wrong URL. Embedded hosts must also set `apiOrigin` (the
+backend origin, e.g. `http://localhost:4000`) on `AdminProvider`. Native `fetch`
+RPC uses that origin to prefix `/admin/config` and `/rbac/roles`. Do not put the
+origin in `apiBase` — that would rewrite in-app navigation.
 
 ## Screen kinds
 
 | Kind | Source of truth | Frontend |
 | --- | --- | --- |
-| Model changelist / form | `modelRouter({admin: ...})` or plugin `adminContribution()` | `AdminScreenRouter` → `AdminModelTable` / `AdminModelForm` |
+| Model changelist / form | `modelRouter({admin: ...})` or plugin `adminContribution()` | `AdminScreenRouter` → `AdminModelTable` / `AdminModelForm` (list filters live on `DataTable`, not a side drawer) |
 | Custom screen | `AdminApp.customScreens` or plugin `customScreens` (`name` + `displayName`) | Matching `AdminProvider.widgets.screens[name]`, or a dedicated Expo route |
-| Platform tool | Built-in (`scripts`, `roles`, `version`, `configuration`, audit log, feature flags) | Sidebar **Platform** section; visibility from `/admin/config.platformTools` |
+| Platform tool | Built-in (`scripts`, `roles`, `version`, `configuration`, audit log, feature flags, jobs) | Sidebar **Platform** section; visibility from `/admin/config.platformTools` (jobs is lifted from `customScreens`) |
 | Home widget | `AdminApp.home.slots` IDs | `AdminProvider.widgets.home` (built-ins already registered) |
 
 `GET /admin/config` is caller-specific. Models and custom screens without read
@@ -41,12 +44,16 @@ app-level nav inside admin.
 Order in the rail:
 
 1. **Home** → `{routeBase}/`
-2. **Models** grouped by `admin.group` (ungrouped models land in **General**)
-3. **Screens** from config `customScreens` (plus optional host extras)
-4. **Platform** — Scripts (`/__scripts`), Roles, Version, Audit Log, Feature Flags, Configuration
+2. **Models** grouped by `admin.group` (ungrouped models land in **General**). Custom screens with `group` render inside the matching group **before** model links for that group. A grouped screen with no models still gets its own group heading.
+3. **Screens** — only `customScreens` **without** `group` (plus optional host extras)
+4. **Platform** — Scripts (`/__scripts`), Migrations (`/__migrations` when
+   `migrations.enabled`), Roles, Version, Audit Log, Feature Flags, Jobs, Configuration
 
 Audit log and Feature Flags are models, but the shell lifts them into Platform so
-operators do not hunt for them among business collections.
+operators do not hunt for them among business collections. The Platform Audit Log
+row is `AuditEvent` when `AuditApp` is registered. `isAuditLogModel` also matches
+legacy `AdminAuditLog`, `audit-log`, and `audit-events` names. Jobs is a custom
+screen (`name: "jobs"`); the shell lifts it the same way.
 
 Below 768px the rail becomes a hamburger drawer. The main column is a body-style
 canvas (`neutral-050`). Nested `Page` screens use `color="transparent"` and
@@ -59,12 +66,12 @@ canvas (`neutral-050`). Nested `Page` screens use `color="transparent"` and
 | Concern | Location |
 | --- | --- |
 | Which models appear | `modelRouter` `admin` block, or plugin `adminContribution()` |
-| Extra non-CRUD pages | `AdminApp.customScreens` + `widgets.screens` with the **same** `name` |
+| Extra non-CRUD pages | `AdminApp.customScreens` + `widgets.screens` with the **same** `name`. Optional `group` places the screen in that sidebar group (see **Models** above). |
 | Home dashboard composition | `AdminApp.home.slots` |
 | Field widgets | `admin.fieldOverrides.widget` + `widgets.fields` |
 | Expo files | `app/admin/_layout.tsx` (shell once) or per-route shell in admin-spa |
 | Dedicated extra segments (`/comms/:id`) | Explicit Expo files so `[model]/[id]` does not treat them as generic forms |
-| Data fetching | `useAdminConfig` / `useAdminApi` (RTK). Admin is **not** a syncdb collection |
+| Data fetching | REST remains membership/search/sort/pagination. String `_id` models with `adminBroadcast` overlay TinyBase and write through syncdb when the host passes a window client + fetch auth. Framework RPC uses host-bound fetch; ObjectId/API-only CRUD keeps RTK compatibility in Terreno 57. |
 
 ## Related
 

package/src/docs/versioned/next/explanation/ai-workflows.md

@@ -27,11 +27,11 @@ Analyzes code diffs after each merge to identify:
 **Trigger:** Push to master  
 **Purpose:** Keeps AI assistant rules synchronized with codebase changes
 
-Maintains the single source of truth in `.rulesync/rules/` and ensures:
-- `.cursor/rules/`, skills, agents, and hooks (Cursor)
-- `CLAUDE.md`, `.claude/rules/`, skills, agents, and hooks (Claude Code)
-- `.github/copilot-instructions.md` (GitHub Copilot)
-- Native hooks for Codex CLI, Copilot CLI, Antigravity CLI, and Devin
+Maintains centralized agent guidance and generates the matching configuration for:
+- Cursor
+- Claude Code
+- GitHub Copilot
+- Codex CLI, Copilot CLI, Antigravity CLI, and Devin
 
 **Workflow:**
 1. Detects package changes, new APIs, or convention updates

package/src/docs/versioned/next/explanation/announcements/rtk-deprecation.md

@@ -6,7 +6,7 @@
 
 ## `@terreno/rtk` data sync is deprecated — migrate to `@terreno/syncdb`
 
-Starting with **56.0.0**, Terreno's default frontend data path is **local-first** via [`@terreno/syncdb`](https://github.com/FlourishHealth/terreno/blob/master/docs/reference/syncdb.md). Collection reads and writes apply to an on-device store first; the server reconciles over the sync protocol. This replaces RTK Query hooks for CRUD lists and mutations.
+Starting with **56.0.0**, Terreno's default frontend data path is **local-first** via [`@terreno/syncdb`](https://github.com/TerrenoLabs/terreno/blob/master/docs/reference/syncdb.md). Collection reads and writes apply to an on-device store first; the server reconciles over the sync protocol. This replaces RTK Query hooks for CRUD lists and mutations.
 
 ### What changed
 
@@ -18,12 +18,12 @@ Starting with **56.0.0**, Terreno's default frontend data path is **local-first*
 
 1. **By next major:** move collection screens from RTK Query to syncdb. `@terreno/rtk` will not publish in the next major line.
 2. **Support window:** `@terreno/rtk` continues to publish with a deprecation notice through the **current major** (56.x beta and stable 0.x).
-3. **Recommended order:** migrate to **Better Auth** first, then syncdb per screen ([migration guide](https://github.com/FlourishHealth/terreno/blob/master/docs/how-to/migrate-rtk-to-syncdb.md)).
+3. **Recommended order:** migrate to **Better Auth** first, then syncdb per screen ([migration guide](https://github.com/TerrenoLabs/terreno/blob/master/docs/how-to/migrate-rtk-to-syncdb.md)).
 
 ### Why local-first
 
-Instant UI, durable offline writes, and simpler screen code — at the cost of explicit conflict and sync-status handling. See [local-first data](https://github.com/FlourishHealth/terreno/blob/master/docs/explanation/local-first-data.md).
+Instant UI, durable offline writes, and simpler screen code — at the cost of explicit conflict and sync-status handling. See [local-first data](https://github.com/TerrenoLabs/terreno/blob/master/docs/explanation/local-first-data.md).
 
 ### Questions
 
-Open a thread in [Docs feedback](https://github.com/FlourishHealth/terreno/discussions/categories/docs-feedback) or reply here.
+Open a thread in [Docs feedback](https://github.com/TerrenoLabs/terreno/discussions/categories/docs-feedback) or reply here.

package/src/docs/versioned/next/explanation/charts.md

@@ -0,0 +1,29 @@
+# Why Terreno owns chart SVG
+
+Terreno charts are drawn with `react-native-svg` and private `d3-scale` / `d3-shape` helpers inside `@terreno/ui`. Apps import `LineChart`, `BarChart`, `AreaChart`, and `DonutChart` — not d3 types and not a third-party chart API.
+
+`victory-native` was rejected for this slice: Skia canvas fights Terreno theme fonts, bun tests, and accessibility. Owned SVG lets axis labels stay `@terreno/ui` `Text` (Nunito/Titillium) and lets hit targets stay clickable `Box`es with `testID`s.
+
+`BarChart` grows each bar from the zero baseline (up for positives, down for negatives). A zero value draws no sliver; the press/hover hit stays at least 24px so the tooltip still works.
+
+`DonutChart` uses `d3-shape` `arc` angles (`0` is 12 o'clock, clockwise). Slice press/hover hits use the same paint transform so the tooltip lands on the visible slice.
+
+Axis ticks and donut legend labels use `Text` with `skipLinking`, matching `ChartFrame` tooltips, so a URL in `point.label` stays inert text instead of `Linking.openURL`.
+
+Sizing flows one way: the frame stretches to the container (`alignSelf: stretch`), the plot
+measures itself with `onLayout`, and the drawing is clipped to that measurement. Nothing inside a
+chart may set its own min-content width, or the container would size to the chart and the chart
+would size to the container. That is why x tick labels are absolutely positioned on their band
+centers instead of laid out in a row, and why the plot column sets `minWidth: 0`.
+
+Height works the same way: `height` is the whole chart, and the tick row, tooltip row, and legend
+row come out of that budget. A chart therefore fits a fixed-height slot, and reserving the tooltip
+row even when no tooltip is showing keeps hovering from reflowing the page.
+
+`DashboardGrid` is layout only, so it stays on the eager root export. Chart implementations sit behind the same lazy root boundary as `GPTChat`. Cell width subtracts flex `gap` so `md`/`lg` column counts actually fit.
+
+Chart paint is proven with **rendered PNG goldens**, not React test-renderer JSON.
+`bun run ui:charts:compare` opens the demo gallery
+(`/demo/chart-visual-gallery`), screenshots each fixture from easy to hard, and
+pixel-diffs against `demo/rendered-snapshots/`. Agents use the `review-chart-visuals`
+skill to read golden / actual / diff images when a compare fails.

package/src/docs/versioned/next/explanation/deployment-architecture-gcp.md

@@ -11,6 +11,8 @@ flowchart TD
   U["User<br/>iOS / Android / Web"]
   CDN["Cloud CDN + GCS bucket<br/>expo export -p web output"]
   CR["Cloud Run<br/>@terreno/api backend"]
+  CT["Cloud Tasks<br/>durable jobs push queue"]
+  JW["Cloud Run<br/>private jobs worker service"]
   SM["Secret Manager<br/>auth secrets, MONGO_URI"]
   AT["MongoDB Atlas<br/>replica set (change streams)"]
   GCS["GCS bucket<br/>user file uploads"]
@@ -21,6 +23,9 @@ flowchart TD
   CR --> SM
   CR --> AT
   CR --> GCS
+  CR -->|"enqueue"| CT
+  CT -->|"OIDC POST /jobs/execute"| JW
+  JW --> AT
   AR --> CR
 ```
 
@@ -30,6 +35,8 @@ flowchart TD
 |-----------|------|
 | **Artifact Registry** | Stores versioned backend container images built from `example-backend/Dockerfile` |
 | **Cloud Run** | Runs the long-lived `@terreno/api` process (HTTP + Socket.io) |
+| **Cloud Tasks** | Dispatches persisted `@terreno/jobs` rows to an authenticated HTTP worker with queue-level concurrency limits |
+| **Jobs worker service** | Runs the same example-backend image and job definitions; exposes only the Cloud Tasks execute callback through Cloud Run IAM |
 | **Secret Manager** | Holds `MONGO_URI`, JWT secrets, and other credentials — mounted as env vars |
 | **MongoDB Atlas** | Primary database; must be a replica set for change streams (realtime, feature flags) |
 | **GCS (web bucket)** | Serves static web export; CDN caches at the edge |
@@ -59,6 +66,31 @@ flowchart TD
 
 Native iOS and Android apps call Cloud Run directly; only the web client uses the CDN origin.
 
+## Durable jobs and PR isolation
+
+Cloud Tasks is a push service; it does not expose a pull-consumer API. Cloud Run worker
+pools do not have HTTP ingress, so the example uses a private Cloud Run service as the
+execution pool. Queue rate limits bound dispatch concurrency and Cloud Run scales the
+worker instances.
+
+Production and PR revisions share one queue safely because every task stores its complete
+callback URL. A PR backend targets the matching `pr-<number>` worker tag and uses
+`terreno-example-pr-<number>` as its Mongo database. Removing a preview removes both
+service tags. An old callback then fails closed instead of reaching production or another
+PR. A failed backend preview tag cannot stay on a not-Ready revision: CD rebuilds traffic
+from Ready tags, deploys the new revision without `--tag`, then tags it.
+
+Every example-frontend PR preview is paired with this isolated backend, including
+frontend-only PRs. The exported Netlify bundle targets the matching `pr-<number>` Cloud
+Run tag, whose CORS configuration trusts only that preview origin. Preview clients never
+fall back to the production backend or production database.
+
+Queue IAM grants `cloudtasks.enqueuer` and `iam.serviceAccountUser` on
+`terreno-jobs-invoker` only to `terreno-backend-runtime`, the example API Cloud Run
+identity. The project default Compute Engine SA (MCP and any other service that omits a
+runtime identity) cannot create tasks that present that OIDC token. The worker remains
+invokable only by `terreno-jobs-invoker`.
+
 ## Related
 
 - [Deployment baseline](deployment-baseline.md) — seven requirements every host must satisfy

package/src/docs/versioned/next/explanation/deployment-baseline.md

@@ -46,7 +46,7 @@ Expo Router supports three web output modes. The choice determines hosting optio
 |------|--------|-----------|-----|---------|----------------|
 | `single` | One `index.html` SPA | No | No | Any static host | **Current default** |
 | `static` | Per-route HTML files | No | No | Any static host | Available; better SEO |
-| `server` | `dist/client` + `dist/server` | Yes | Yes (alpha, SDK ≥ 55) | Node/Bun/edge runtime | Not yet — repo catalog is Expo `~54.0.29`; see [Web SSR and admin SPA](https://github.com/FlourishHealth/terreno/blob/master/docs/implementationPlans/web-ssr-and-admin-spa.md) |
+| `server` | `dist/client` + `dist/server` | Yes | Yes (alpha, SDK ≥ 55) | Node/Bun/edge runtime | Not yet — repo catalog is Expo `~54.0.29`; see [Web SSR and admin SPA](https://github.com/TerrenoLabs/terreno/blob/master/docs/implementationPlans/web-ssr-and-admin-spa.md) |
 
 ## Multi-environment checklist
 
@@ -63,7 +63,7 @@ Staging and production differ in these values (each environment needs its **own
 
 ## Containerizing the backend
 
-The canonical Dockerfile is [`example-backend/Dockerfile`](https://github.com/FlourishHealth/terreno/blob/master/example-backend/Dockerfile). It:
+The canonical Dockerfile is [`example-backend/Dockerfile`](https://github.com/TerrenoLabs/terreno/blob/master/example-backend/Dockerfile). It:
 
 1. Installs workspace dependencies and compiles packages in dependency order.
 2. Builds a Bun-compiled binary for production.
@@ -73,6 +73,6 @@ Three details consumers get wrong:
 
 - **`PORT`** — Cloud Run and other platforms assign the listen port via `PORT`. Terreno reads `process.env.PORT` in `api/src/terrenoApp.ts` (default `9000` if unset).
 - **Non-root** — Do not run the container as root in production.
-- **Compile order** — Workspace packages (`@terreno/api`, `@terreno/test`, etc.) must compile before the example backend bundles.
+- **Compile order** — Workspace packages (`@terreno/api`, `@terreno/jobs`, `@terreno/test`, etc.) must compile before the example backend bundles. Compile `@terreno/jobs` before `@terreno/admin-backend` — admin-backend imports jobs. The image `exports` point at `dist/`, so skipping a workspace compile fails `bun build --compile` with an unresolved `@terreno/*` import.
 
 CI builds the image on every PR that touches backend paths (`.github/workflows/example-backend-docker.yml`).

package/src/docs/versioned/next/explanation/example-coverage.md

@@ -0,0 +1,44 @@
+# Example app coverage
+
+The `example-backend` and `example-frontend` apps are the living checklist for
+framework capabilities. When you add a capability to `@terreno/*`, update this
+matrix in the same slice.
+
+Citations are paths from the repository root. A "yes" means a reader can follow
+that file (and its imports) to a working example. Gaps stay explicit.
+
+## Capability matrix
+
+| Capability | example-backend | example-frontend | Notes |
+| --- | --- | --- | --- |
+| `modelRouter` CRUD | yes — `example-backend/src/api/todos.ts` | yes — `example-frontend/components/SyncTodosScreen.tsx` (syncdb hooks generated from the same collection) | Todos are synced; list/create/update/delete go through `@terreno/syncdb`, not RTK collection hooks. |
+| Owner permissions | yes — `OwnerQueryFilter` + `Permissions.IsOwner` in `example-backend/src/api/todos.ts` | yes — the todos screen only shows the signed-in user's rows after sync scopes apply | Also gated by RBAC `access: {resource: "todo"}`. |
+| Admin panel (embedded) | yes — Admin plugin registration in `example-backend/src/server.ts` | yes — `example-frontend/app/admin/` | Expo routes wrap `@terreno/admin-frontend` screens. |
+| Admin SPA | yes — `AdminSpaServeApp` in `example-backend/src/server.ts` | n/a | Standalone SPA is served from the backend; not a frontend route. |
+| AI streaming chat | yes — `example-backend/src/api/ai.ts` (`addGptRoutes`) | yes — `example-frontend/app/(tabs)/ai.tsx` (`GPTChat`, optional `mascot`) | Empty-chat mascot is consumer-owned; the example fox is not a framework default. |
+| AI structured output | no | no | `@terreno/ai` supports structured generation; the example only streams chat. Recorded gap — not claimed by a current tutorial. |
+| Feature flags + live updates | yes — `FeatureFlagsApp` in `example-backend/src/server.ts`, seed `example-backend/src/scripts/seed-feature-flags.ts` | yes — `useTerrenoFeatureFlags` in `example-frontend/app/_layout.tsx` | Socket-backed live updates share the realtime connection. |
+| Websockets / realtime | yes — `RealtimeApp` in `example-backend/src/server.ts`, `example-backend/src/websockets.ts` | yes — `useSocketConnection` in `example-frontend/app/_layout.tsx` | Sync deltas also use the socket (`SyncApp` + `@terreno/syncdb`). |
+| Consent forms | yes — `example-backend/src/consentDefinitions.ts`, seed scripts | yes — `example-frontend/app/(tabs)/consents.tsx`, admin `example-frontend/app/admin/consent-forms/` | First-login flow is covered by e2e (`example-frontend/e2e/consents.spec.ts`). |
+| File upload / GCS | yes — `example-backend/src/api/settings.ts`, AI file routes in `example-backend/src/api/ai.ts` | yes — `example-frontend/app/(tabs)/files.tsx`, `example-frontend/app/gcs-settings.tsx` | |
+| Better Auth | yes — `example-backend/src/utils/betterAuthConfig.ts`, `BetterAuthApp` in `example-backend/src/server.ts` | yes — `example-frontend/app/login.tsx`, `example-frontend/lib/betterAuth.ts` | Default `AUTH_PROVIDER` is `better-auth`. |
+| syncdb local-first | yes — `SyncApp` in `example-backend/src/server.ts` | yes — `example-frontend/store/syncdb.ts`, `example-frontend/app/(tabs)/index.tsx` | PR #869 closed without merge; `@terreno/syncdb` shipped on the launch line and is the example todos path. |
+| SyncDB diagnostics | n/a | yes — `debug` registration in `example-frontend/store/syncdb.ts`, debugger UI at `example-frontend/app/syncdb-debug.tsx` | `terreno-mcp-local` can inspect, snapshot/compare/merge, mutate, flush, reconcile/resync, and exercise offline/conflict paths against the running development client. |
+| RBAC | yes — `example-backend/src/rbacRoles.ts`, `access.ts`, `access: {resource: "todo"}` on the todo router | yes — `example-frontend/app/admin/roles.tsx` | Shipped. The IP snapshot that marked RBAC "not shipped" is stale. Plan: [rbac-permissions.md](../implementationPlans/rbac-permissions.md). |
+| Organizations | yes — `createAccess({organizations: true})`, `organizationSettingsSchema`, `orgScopedPlugin` on projects | yes — admin org directory/settings at `example-frontend/app/admin/orgs/` | Settings live on `Organization.settings`; example registers a nested timezone schema. |
+| Background jobs | no | no | No generic job queue example. Admin maintenance scripts (`example-backend/src/adminScripts.ts`, script runner widget) are a related but different surface. Plan: [admin-script-runner.md](../implementationPlans/admin-script-runner.md). |
+
+## Gaps
+
+| Gap | Why it stays | Follow-up |
+| --- | --- | --- |
+| AI structured output | Chat streaming already demonstrates the AI pillar; structured `generateObject`-style routes are unused by current tutorials | Track with [AI-first tutorials #1010](https://github.com/TerrenoLabs/terreno/issues/1010) (`add-ai-features.md` requires one structured-output call). |
+| Generic background jobs | Unshipped as a first-class example; do not invent a queue UI here | Track with [Durable background jobs #1188](https://github.com/TerrenoLabs/terreno/issues/1188). Admin script runner is a related surface — [admin-script-runner.md](../implementationPlans/admin-script-runner.md). |
+
+## Keeping the matrix true
+
+When you add a framework capability:
+
+1. Exercise it in `example-backend` and/or `example-frontend`.
+2. Update this page (cite the file).
+3. Mention the example in the PR.

package/src/docs/versioned/next/explanation/local-first-data.md

@@ -27,7 +27,10 @@ Think **apply locally, then reconcile** instead of **request, wait, update cache
 3. **Refetch orchestration** — `invalidatesTags`, `refetch()`, and list/detail cache coordination after mutations.
 4. **Treating the network as the read path** — list screens blocked on `isLoading` for every navigation.
 
-RTK Query remains appropriate for **non-synced** endpoints: `/auth/me`, admin RPC, AI routes, and anything that should stay request/response.
+RTK Query remains appropriate for **non-synced generated** endpoints such as
+`/auth/me` and AI routes. Built-in admin RPC stays request/response through its
+host-bound fetch client; ObjectId/API-only admin CRUD keeps RTK compatibility in
+Terreno 57.
 
 ## What you start doing
 
@@ -35,7 +38,7 @@ RTK Query remains appropriate for **non-synced** endpoints: `/auth/me`, admin RP
 2. **Sync-status UX** — Surface offline state, queued mutations, and drain progress with `useSyncStatus` (and optionally `SyncStatusBanner`).
 3. **Encryption at rest (web)** — Web persistence uses AES-GCM via the default `createServerKeyProvider`; understand key fetch and `onDecryptFailure` for support flows.
 4. **Key lifecycle on logout** — Call `syncDb.stop()` and consider `wipeLocalData` when the authenticated user changes so one account does not read another's local store.
-5. **Backend sync registration** — Every synced collection needs `syncPlugin`, `isDeletedPlugin`, and a `sync` block on `modelRouter`, plus `SyncApp` and `RealtimeApp` on the server.
+5. **Backend sync registration** — Every synced collection needs `syncPlugin`, `isDeletedPlugin`, and a `sync` block on `modelRouter`, plus `SyncApp` and `RealtimeApp` on the server. Optional `sync.adminBroadcast: true` also emits `sync:delta` to `{collection}|admin`. Admin clients subscribe with `mode: "window"` (`createSyncDb({windowCollections})`) so they do not snapshot or reconcile that collection; they call `hydrateWindow` (REST membership ids + `GET /sync/entities`). Pass the same `accessControl` into `SyncApp` that `AdminApp` uses so `{collection}|admin` requires `admin:access`. `AdminApp.register` also installs that model's admin list/read/`queryFilter` on the admin window so hydrate and live `|admin` deltas match `/admin` REST. Without RBAC, `user.admin` is enough for the shell gate. Live deltas on that stream apply only to ids already in the window; Refresh is a REST re-query plus `hydrateWindow`.
 
 ## Tradeoffs