docs: TODO stale-status corrections — items 2, 7(A1/A2), 14 already shipped on main

[lopugit]

Session-6 of the parallel todo loops audited the 'unclaimed' TODO items against origin/main before claiming and found several URGENT-flagged items already fixed:

• Item 7 A1/A2 (unauth raw-results exfiltration + populate seeding): both routes now require admin (requireAdmin) and fail-closed enforceRateLimit; raw-results only runs bounded read-only queries via runMongoQuery. A3 is in flight in PRs security: rate-limit + input-cap public service-account provisioning (TODO #7 A3) #100/security: rate-limit + 16KiB body cap on public signup (TODO item 8 remainder) #103.
• Item 2 (verification-link origin trust): appOrigin.ts resolveTrustedOrigin prefers server-configured APP_URL; remaining step is ops (set APP_URL in deploy envs).
• Item 14 (render-time debug leaks): window.useThingtimeScope push is gone; remainder is 4 console.logs in ThingtimeURL.tsx.

Marking these in TODO/TODO.md + claude-todo/09-security-hardening.md so parallel sessions stop re-claiming fixed items (three sessions independently PR'd TODO 9 today — the stale list is expensive).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
thingtime	Ready	Preview	Aug 9, 2026 3:01pm

[github-actions]

🧬 Rebased claude/todo-stale-status-corrections-s6 onto develop with the AI PR/stack rebase workflow.

• Previous head: cf3791f1c9149e5eac8cdf0f675f853099f97d42
• Rewritten head: a7074b1eb33d5bf87fb5190822ea3d65f32ba030
• graphify: refreshed and committed (semantic mode: none)
• Direct stacked children dispatched: 0

The branch was published once with an exact force-with-lease. Please review the rewritten commits before relying on them.

[github-actions]

🤖 Auto-resolve running — the conflict resolver started working on this PR at 14:30 UTC.

Expected to finish around 14:38 UTC (resolutions typically land in 3-8 minutes; the job times out at 30). On success a merge commit resolving the conflicts is pushed to this branch and a result comment follows — no manual action is needed meanwhile.

Live status

[github-actions]

🤝 Merged develop into claude/todo-stale-status-corrections-s6 — conflicts auto-resolved by the resolve-pr-conflicts workflow.

No AI resolution was needed by merge time; the branch was updated with a plain merge commit.

graphify-out/ was reset wholesale to the develop side (repo rule: one side, never mixed — the graph merge driver is unavailable in CI).
Then re-ran graphify update (AST/text-only — the semantic extraction attempt failed this run; see the workflow log) and committed the result. Run graphify locally with an LLM backend if fresh semantic data is needed.

Please review the merge commit before relying on it.

[github-actions]

🤖 Auto-rebase running — the stack rebase started working on this PR at 11:51 UTC.

Expected to finish around 12:06 UTC (rebases typically land in 5-15 minutes; the job times out at 55). On success this branch is force-pushed onto its new base and a result comment follows — no manual action is needed meanwhile.

Live status

[github-actions]

🧬 Rebased claude/todo-stale-status-corrections-s6 onto develop with the AI PR/stack rebase workflow.

• Previous head: a7c4a045d99e0152cb53732696b7d90988b92f10
• Rewritten head: 9079be261a31bcced8a2156828c25905c7865119
• graphify: refreshed and committed (semantic mode: none)
• Direct stacked children dispatched: 0

The branch was published once with an exact force-with-lease. Please review the rewritten commits before relying on them.

[github-actions]

🤝 Merged develop into claude/todo-stale-status-corrections-s6 — conflicts auto-resolved by the resolve-pr-conflicts workflow.

No AI resolution was needed by merge time; the branch was updated with a plain merge commit.

graphify-out/ was reset wholesale to the develop side (repo rule: one side, never mixed — the graph merge driver is unavailable in CI).
Then re-ran graphify update (AST/text-only — the semantic extraction attempt failed this run; see the workflow log) and committed the result. Run graphify locally with an LLM backend if fresh semantic data is needed.

Please review the merge commit before relying on it.

[github-actions]

🧬 Rebased claude/todo-stale-status-corrections-s6 onto develop with the AI PR/stack rebase workflow.

• Previous head: 54e634ea7cef5165a2fc3f7c61c471c71dcc3022
• Rewritten head: 5037bd9f9568e3d007116e0df882102fe546bacd
• graphify: refreshed and committed (semantic mode: none)
• Direct stacked children dispatched: 0

The branch was published once with an exact force-with-lease. Please review the rewritten commits before relying on them.

[github-actions]

⚠️ Could not auto-resolve conflicts with develop — manual resolution needed. See the workflow run.

[github-actions]

🤝 Merged develop into claude/todo-stale-status-corrections-s6 — conflicts auto-resolved by the resolve-pr-conflicts workflow.

No AI resolution was needed by merge time; the branch was updated with a plain merge commit.

graphify-out/ was reset wholesale to the develop side (repo rule: one side, never mixed — the graph merge driver is unavailable in CI).
Then re-ran graphify on the merged code WITH LLM semantic extraction (graphify extract, claude-cli backend) and committed the result — content new to this merge is semantically indexed; unchanged content came from the tracked cache.

Please review the merge commit before relying on it.