July 3rd - Update documents

CLAUDE.md

@@ -228,7 +228,7 @@ lt_janitorial_quality_control/
 | `CONTROL_FERNET_KEY` | Fernet key for encrypting tenant DB passwords. Generate once; store in `/etc/jqc/control.env`. |
 | `PROVISION_DB_URL` | MySQL account that can `CREATE DATABASE` / `CREATE USER` / `GRANT`. e.g. `mysql+pymysql://jqc_provisioner:pw@127.0.0.1/`. |
 | `TENANT_BASE_DOMAIN` | Apex domain for subdomains, e.g. `jqc.app`. Used by provisioner to build `<slug>.jqc.app`. |
-| `MULTI_TENANT_EXEMPT_PATHS` | Comma-separated path prefixes that bypass the tenant gate (e.g. `/health,/api/v1/discover`). `/static/` is always exempt. |
+| `MULTI_TENANT_EXEMPT_PATHS` | Comma-separated path prefixes that bypass the tenant gate (e.g. `/health`). `/static/`, `/signup`, `/welcome`, and the cross-tenant cron paths are always exempt (see `_is_exempt()` in `app/tenancy/middleware.py`). |
 | `TENANT_ENGINE_POOL_SIZE` | Per-tenant engine pool size (default 5). |
 | `TENANT_ENGINE_MAX_OVERFLOW` | Per-tenant pool max overflow (default 5). |
 | `TENANT_ENGINE_POOL_RECYCLE` | Pool recycle in seconds (default 1800). |
@@ -486,7 +486,7 @@ The `DeviceRegistration` model and the duplicate `api_devices` blueprint were **
 | `api_notifications` | `/api/v1` | `GET /notifications`, `PATCH /notifications/mark-read` |
 | `api_stats` | `/api/v1` | `GET /stats/dashboard` — inspector-scoped KPIs with severity breakdown (Phase B) |
 | `api_comments` | `/api/v1` | `GET /issues/<id>/comments`, `POST /issues/<id>/comments` (Phase D) |
-| `api_discovery` | `/api/v1` | `GET /discover?subdomain=` or `?email=`, `GET /tenant` — MT-9 server side (public, no auth, exempt from tenant middleware) |
+| `api_discovery` | `/api/v1` | **NOT YET IMPLEMENTED (MT-9 pending).** Planned public discovery endpoints (`GET /discover?subdomain=` or `?email=`, `GET /tenant`), no auth, to be exempt from tenant middleware. No blueprint or route exists in the code yet — do not reference these as live. |
 | `tenant_settings` | `/settings` | MT-7: `GET/POST /branding`, `GET /plan`, `GET /domains`, `POST /domains/request`, `POST /domains/<id>/delete` |
 | `billing` | `/billing` | `GET /subscribe`, `POST /subscribe`, `GET /portal`, `POST /webhook`, `GET /suspended` |
 | `signup` | `/signup` | `GET /`, `POST /` — public self-service signup (exempt from tenant middleware). Free plan → provisioned `active` (free forever); paid plans → 14-day trial |

MULTI_TENANT_PLAN.md

@@ -2,7 +2,7 @@
 
 > **Audience:** AI assistants and developers extending JQC into a multi-tenant SaaS.
 > **Companion to:** `CLAUDE.md` (single-tenant architecture reference).
-> **Status:** MT-0 through MT-8 complete and deployed (MT-8 billing is flag-gated behind `BILLING_ENABLED`, default off). MT-9 (iOS) server-side endpoints exist; iOS client pending.
+> **Status:** MT-0 through MT-8 complete and deployed (MT-8 billing is flag-gated behind `BILLING_ENABLED`, default off). MT-9 (iOS multi-tenant) is fully pending — both the server-side discovery endpoints and the iOS client are unbuilt.
 
 ---
 
@@ -221,8 +221,8 @@ Self-service features:
 **MT-8 — Billing. ✅ DONE — flag-gated behind `BILLING_ENABLED` (default off).**
 Stripe per-plan subscription, fully implemented in `app/billing/` (`routes.py`, `webhooks.py`, `emails.py`, `stripe_client.py`; blueprint registered + CSRF-exempted in `app/__init__.py`). Lifecycle: trial → active → past_due → suspended → cancelled. Billing gate (`_billing_gate()` in `app/tenancy/middleware.py`) enforces trial expiry + cancellation on every request. Dunning sequence (day 3/7/14) via cron `POST /notifications/dunning-reminders`, tracked by three `Tenant` columns (`past_due_since`, `dunning_stage`, `dunning_sent_at`; migration `control0004_dunning_tracking`). HTML + plain-text lifecycle emails, invoice history on `/settings/plan`, superadmin billing controls on the panel, and public self-service signup (`/signup`) with 14-day trial + welcome email. See CLAUDE.md §23 for the full reference.
 
-**MT-9 — iOS multi-tenant. 🔲 PENDING.**
+**MT-9 — iOS multi-tenant. 🔲 PENDING (server + client both unbuilt).**
-Server side: `GET /api/v1/discover?subdomain=acme` and `GET /api/v1/tenant` public endpoints — exempt from tenant middleware via `MULTI_TENANT_EXEMPT_PATHS`. iOS side: pending (web-first priority).
+Planned server side: `GET /api/v1/discover?subdomain=acme` and `GET /api/v1/tenant` public endpoints — to be exempt from tenant middleware via `MULTI_TENANT_EXEMPT_PATHS`. **Neither endpoint exists in the code yet** — no `api_discovery` blueprint is registered. iOS side: also pending (web-first priority).
 
 ---
 

app/routes/signup.py

@@ -8,9 +8,11 @@ tenant middleware so no tenant context is required. On success, a new tenant
 database is provisioned (schema + first admin) and the user is redirected to
 their subdomain's login page.
 
-Trial period: every signup starts a 14-day free trial (subscription_status =
+Trial period: paid-plan signups start a 14-day free trial (subscription_status
-'trial', trial_ends_at = now + 14 days). After the trial the billing gate
+= 'trial', trial_ends_at = now + 14 days); after the trial the billing gate
-redirects to /billing/subscribe.
+redirects to /billing/subscribe. The Free plan is free-forever — it is
+provisioned with trial_days=0 (subscription_status = 'active', no expiry) so
+the billing gate never blocks it. See CLAUDE.md rule 86.
 """
 
 import re