chore(work): finish 03-no-undeclared-rate-limit-eslint-rule

docs/work/_system/_state.json

@@ -1,5 +1,5 @@
 {
-  "updated_at": "2026-05-20T08:38:25.437Z",
+  "updated_at": "2026-05-20T08:45:03.332Z",
   "epics": {
     "binder-wrap-helper": {
       "status": "done",
@@ -591,10 +591,10 @@
           "blocks": []
         },
         "03-no-undeclared-rate-limit-eslint-rule": {
-          "status": "todo",
+          "status": "done",
           "title": "`no-undeclared-rate-limit` ESLint rule",
           "ac_total": 1,
-          "ac_completed": 0,
+          "ac_completed": 1,
           "depends_on": [
             "01-rate-limit-type-primitives"
           ],
@@ -686,11 +686,6 @@
     }
   },
   "ready": [
-    {
-      "epic": "security-headers-rate-limit-sbom",
-      "story": "03-no-undeclared-rate-limit-eslint-rule",
-      "title": "`no-undeclared-rate-limit` ESLint rule"
-    },
     {
       "epic": "security-headers-rate-limit-sbom",
       "story": "04-with-rate-limit-wrapper-and-conformance",

docs/work/epics/security-headers-rate-limit-sbom/03-no-undeclared-rate-limit-eslint-rule/_story.md

@@ -3,12 +3,12 @@ id: 03-no-undeclared-rate-limit-eslint-rule
 epic: security-headers-rate-limit-sbom
 title: "`no-undeclared-rate-limit` ESLint rule"
 type: technical-story
-status: todo
+status: done
 feature: core-eslint
 depends-on: [01-rate-limit-type-primitives]
 blocks: [05-auth-signin-rate-limit-backfill]
 created: 2026-05-20T00:00:00Z
-updated: 2026-05-20T08:14:55.907Z
+updated: 2026-05-20T08:45:03.170Z
 ---
 
 ## Goal
@@ -42,4 +42,4 @@ Without a lint rule, an agent could add a `consume("foo", ...)` call that has no
 
 ## Tasks
 
-- [ ] Add `no-undeclared-rate-limit` rule in `packages/core-eslint/rules/no-undeclared-rate-limit.js` (warn severity); extend `packages/core-eslint/rules/_manifest-ast.js` to extract the `rateLimit` field; register the rule in `plugin.js` + `base.js`; add RuleTester fixtures: declared budget + matching call (pass), undeclared budget name in call (warn), declared budget never consumed (warn), non-use-case file (no-op); all gates pass.
+- [x] Add `no-undeclared-rate-limit` rule in `packages/core-eslint/rules/no-undeclared-rate-limit.js` (warn severity); extend `packages/core-eslint/rules/_manifest-ast.js` to extract the `rateLimit` field; register the rule in `plugin.js` + `base.js`; add RuleTester fixtures: declared budget + matching call (pass), undeclared budget name in call (warn), declared budget never consumed (warn), non-use-case file (no-op); all gates pass.

docs/work/epics/security-headers-rate-limit-sbom/_epic.md

@@ -7,7 +7,7 @@ status: in-progress
 features:
   [core-shared, core-testing, core-eslint, auth, web-next, web-tanstack, cms]
 created: 2026-05-20T00:00:00Z
-updated: 2026-05-20T08:38:25.271Z
+updated: 2026-05-20T08:45:03.170Z
 ---
 
 ## Goal
@@ -22,7 +22,7 @@ Security scanners flag the absence of HSTS, X-Frame-Options, X-Content-Type-Opti
 
 - [x] [01 — Rate-limit type primitives and manifest field](01-rate-limit-type-primitives/_story.md)
 - [x] [02 — Rate-limit implementations: Noop, InMemory, Recording](02-rate-limit-implementations/_story.md)
-- [ ] [03 — `no-undeclared-rate-limit` ESLint rule](03-no-undeclared-rate-limit-eslint-rule/_story.md)
+- [x] [03 — `no-undeclared-rate-limit` ESLint rule](03-no-undeclared-rate-limit-eslint-rule/_story.md)
 - [ ] [04 — `withRateLimit` wrapper and conformance extensions](04-with-rate-limit-wrapper-and-conformance/_story.md)
 - [ ] [05 — auth.signIn rate-limit backfill](05-auth-signin-rate-limit-backfill/_story.md)
 - [ ] [06 — Security headers core module](06-security-headers-core-module/_story.md)