[cursor]

Docs added/updated

Living docs only (no new pages):

• docs/user-guide.md — Compare 2,000 rows, 2,000-op migrate cap, personal-workspace role ceiling, Demo / app.write, Redis keys as tables
• docs/FEATURE_MAP.md + docs/feature-map.html — catalog, request path, known gaps, inventory counts
• docs/ARCHITECTURE.md — INSTALL_PERMISSIONS includes app.write / account.self; reads check; role ceiling; Redis/MongoDB none auth
• docs/CODE_MAP.md — where reads, cappedRole, DATA_MIGRATE_MAX_OPS, wrapSqlForOrderedPage, and Redis keyspace live
• docs/architecture/FEATURE-MODULE-GUIDE.md — new POST must declare reads or a Demo account is refused
• docs/releases/UNRELEASED.md — release notes for the same
• docs/plans/2026-10-17-data-compare-and-sql-tracer.md — status banner only (Parts 1 and 3 built; SQL Tracer not)

Codepaths they cover

• Editor compare window: useCompareWindow → POST /api/sql/execute with orderBy → wrapSqlForOrderedPage (COMPARE_WINDOW_ROWS = 2,000, +1 probe)
• Data migrate: client DATA_MIGRATE_ROW_CAP and POST /api/data-migrate/execute share DATA_MIGRATE_MAX_OPS
• Read-only: authGuard + requestAllowed + router reads marker; Demo role lacks app.write / account.self
• Workspace ceiling: workspaceRoleCeiling / cappedRole / memberRoleCeiling
• Connections: authMethod: none on Redis/MongoDB; Redis prefix vs collection tables in redis.keyspace.ts

Knowledge gaps addressed

• User guide still said migrate stops at 500 ops and only described OFFSET-page compare
• FEATURE_MAP still listed compare-2,000, No password, and app.write/reads as open work (all shipped in feat(connections): Redis and MongoDB offer No password as a login method #557–feat(rbac): read-only is a permission; routes declare that they read #561)
• Force-migrate e2e exists (schema-force-migrate); the map no longer calls it missing
• Developers adding a POST that only reads had no guide for the reads marker (Demo accounts would 403)
• Personal-workspace invite ceiling was in tests only — a viewer could look able to invite an owner

SQL Tracer remains unbuilt and stays on the gap list.

  

---

Note

Low Risk
Documentation-only changes with no runtime or API behavior modified in this diff.

Overview
This PR updates living documentation so it matches shipped behavior (#557–#561) instead of listing those items as open work or outdated limits.

User-facing and release notes (user-guide.md, UNRELEASED.md) now describe Compare 2,000 rows (key-ordered window, in-memory filters/paging), data migrate capped at 2,000 ops (shared with the API), read-only via app.write and the Demo role, personal-workspace role ceiling on invites/grants, and Redis keys as tables plus No password auth for Redis/MongoDB.

Architecture and developer maps (ARCHITECTURE.md, CODE_MAP.md, FEATURE-MODULE-GUIDE.md) document the reads router marker for POSTs that only read, authGuard + requestAllowed, workspaceRoleCeiling / cappedRole, code locations (redis.keyspace.ts, wrapSqlForOrderedPage, DATA_MIGRATE_MAX_OPS), and a checklist item that new POSTs must declare reads or Demo accounts get 403.

Feature inventory (FEATURE_MAP.md, feature-map.html) refreshes counts (155 routes, 56 e2e specs, ~600 unit tests), the request-path diagram (app.write or GET / reads before workspace scope), catalog rows for data compare / connections / workspaces, removes resolved gaps (compare 2,000, force-migrate e2e), and marks SQL Tracer as still unbuilt.

Plan status (2026-10-17-data-compare-and-sql-tracer.md) is updated: Parts 1 and 3 built; Part 2 (SQL Tracer) not.

^{Reviewed by Cursor Bugbot for commit 1bd6b3b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: bc78b7b9-ef52-46d5-9e48-00b0481f1ec0)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: eff70514-e50d-4dae-ae59-ef4692a6eb48)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: ffe17dea-fd7d-4f07-870a-45bb157ac11d)