fix production issues

docs/project-design/FEATURES.md

@@ -35,6 +35,7 @@ There is no separate frontend app for a white-label company public site in this
 
 - Company-scoped vehicles, customers, reservations, offers, payments, complaints, and notifications
 - API tenant isolation through employee auth plus `companyId` scoping
+- Cross-tenant negative regression suite (`cross-tenant-isolation` integration tests)
 - Company profile, brand, contract settings, insurance policies, pricing rules, and accounting settings
 - Public API key generation/regeneration for company integrations
 
@@ -76,10 +77,12 @@ There is no separate frontend app for a white-label company public site in this
 
 - SaaS trial and subscription lifecycle
 - Subscription status handling including `TRIALING`, `ACTIVE`, `PAYMENT_PENDING`, `PAST_DUE`, `SUSPENDED`, `CANCELLED`, `EXPIRED`, `PAUSED`, `UNPAID`
-- Plan pricing loaded from DB or fallback config
+- Plan pricing and entitlements from a single catalog (`packages/types` `planCatalog`) with DB overrides where configured
+- Homepage marketing prices derived from the same catalog
 - AmanPay and PayPal provider support for SaaS subscription checkout
 - Subscription invoice history
 - Platform billing accounts, billing invoices, billing events, refunds, credit notes, and tax records
+- Canonical billing models preferred over legacy subscription-invoice-only writes (see `docs/BILLING_NOTIFICATION_SOURCE_OF_TRUTH.md`)
 
 ### Rental payments
 
@@ -97,6 +100,16 @@ There is no separate frontend app for a white-label company public site in this
 - In-app notifications
 - Notification templates and per-channel preferences
 - Notification history for company users
+- Durable notification outbox with leased dispatch on `api-worker` (Redis publish for IN_APP)
+- Canonical event/recipient/delivery models preferred over legacy flat notifications
+
+### Ops and production-readiness baselines
+
+- `GET /ready` and `GET /metrics` on the API
+- Shared Redis rate limiting and Carplace idempotency
+- Optional S3/MinIO file storage driver
+- OpenAPI coverage CI gate
+- Design summary: `docs/design/`
 
 ### Reservation-adjacent advanced operations
 
@@ -112,6 +125,7 @@ There is no separate frontend app for a white-label company public site in this
 ### Admin app
 
 - Admin login and password reset
+- Admin 2FA enrollment; fresh 2FA required for money / high-privilege mutations (TTL)
 - Admin dashboard
 - Company management
 - Renter management
@@ -121,6 +135,7 @@ There is no separate frontend app for a white-label company public site in this
 - Pricing configuration and promotions
 - Notification review
 - Carplace/site config management
+- Per-tenant Docker/container orchestration UI is **out of scope** (ADR-001)
 
 ## Present But Not Active Product Features
 
@@ -135,6 +150,8 @@ These exist partially in code or schema, but they are not active end-user produc
 - Admin impersonation through Clerk sessions
 - Multi-currency SaaS checkout beyond `MAD`
 - Separate white-label company-site frontend app
+- Per-tenant Docker container orchestration (explicitly disabled — ADR-001)
+- Microservice extraction of payments/webhooks/media (deferred — ADR-003)
 
 ## Explicitly Out Of Scope For Current Docs