Fix high-severity spec drift across 10 specs
- rate-limiting: correct BRouter limit to 300/hour (was 60); add Overpass
rate-limit requirement (120/min per IP)
- security-hardening: BROUTER_AUTH_TOKEN lives in secrets.app.env, not infra.env
- account-management: email-change verification does not re-auth; existing
session stays valid
- planner-journal-handoff: full rewrite — documents the actual JWT callback
architecture (edit-in-planner → POST /api/sessions → callback endpoint),
token claims, notes round-trip via GPX <metadata><desc>, session lifecycle
- route-drag-reshape: rewrite to describe permanent segment midpoint handles
(not proximity hover ghost marker); click-to-insert + waypoint drag model
- route-splitting: rewrite to match midpoint handle model; notes geometric
midpoint placement (not cursor-snapped)
- road-type-coloring: redirect to route-coloring (all requirements already
covered there)
- osm-tile-overlays: mark profile-aware auto-enable as not yet implemented
(profileOverlayDefaults exported but not wired)
- osm-poi-overlays: zoom threshold is 10 not 12; user override persistence
marked as not yet implemented
- shared-packages: add all 7 missing packages (map-core, fit, api, db, jobs,
sentry-config, correct map description); document map vs map-core boundary
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
47eb2615ec