diff --git a/docs/work/_system/_state.json b/docs/work/_system/_state.json
index 9277e48..39f114f 100644
--- a/docs/work/_system/_state.json
+++ b/docs/work/_system/_state.json
@@ -1,5 +1,5 @@
 {
-  "updated_at": "2026-05-20T08:24:33.457Z",
+  "updated_at": "2026-05-20T08:32:32.756Z",
   "epics": {
     "binder-wrap-helper": {
       "status": "done",
@@ -581,10 +581,10 @@
           "blocks": []
         },
         "02-rate-limit-implementations": {
-          "status": "todo",
+          "status": "in-progress",
           "title": "Rate-limit implementations — Noop, InMemory, Recording",
           "ac_total": 2,
-          "ac_completed": 0,
+          "ac_completed": 1,
           "depends_on": [
             "01-rate-limit-type-primitives"
           ],
diff --git a/docs/work/epics/security-headers-rate-limit-sbom/02-rate-limit-implementations/_story.md b/docs/work/epics/security-headers-rate-limit-sbom/02-rate-limit-implementations/_story.md
index 1f567ab..b5d4f77 100644
--- a/docs/work/epics/security-headers-rate-limit-sbom/02-rate-limit-implementations/_story.md
+++ b/docs/work/epics/security-headers-rate-limit-sbom/02-rate-limit-implementations/_story.md
@@ -3,7 +3,7 @@ id: 02-rate-limit-implementations
 epic: security-headers-rate-limit-sbom
 title: Rate-limit implementations — Noop, InMemory, Recording
 type: technical-story
-status: todo
+status: in-progress
 feature: core-shared
 depends-on: [01-rate-limit-type-primitives]
 blocks:
@@ -12,7 +12,7 @@ blocks:
     05-auth-signin-rate-limit-backfill,
   ]
 created: 2026-05-20T00:00:00Z
-updated: 2026-05-20T08:14:55.907Z
+updated: 2026-05-20T08:32:32.585Z
 ---
 
 ## Goal
@@ -45,5 +45,5 @@ The `withRateLimit` wrapper (Story 04) and the `auth.signIn` backfill (Story 05)
 
 ## Tasks
 
-- [ ] Implement `NoopRateLimit` in `packages/core-shared/src/rate-limit/noop-rate-limit.ts` with sibling unit test (consume always allowed, reset no-op); implement `InMemoryRateLimit` in `packages/core-shared/src/rate-limit/in-memory-rate-limit.ts` with sibling unit test (per-bucket tracking, check-at-read expiry via injected clock, explicit reset restores budget); export both from `core-shared` barrel; all gates pass.
+- [x] Implement `NoopRateLimit` in `packages/core-shared/src/rate-limit/noop-rate-limit.ts` with sibling unit test (consume always allowed, reset no-op); implement `InMemoryRateLimit` in `packages/core-shared/src/rate-limit/in-memory-rate-limit.ts` with sibling unit test (per-bucket tracking, check-at-read expiry via injected clock, explicit reset restores budget); export both from `core-shared` barrel; all gates pass.
 - [ ] Implement `RecordingRateLimit` in `packages/core-testing/src/rate-limit/recording-rate-limit.ts` capturing `consume` + `reset` call arguments verbatim with `consumeCalls` + `resetCalls` accessors; sibling test verifies capture correctness; export from `core-testing` barrel; all gates pass.