Bring the todo list up to date

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ei7gCZzdd751uZtPzb1Pep

todo.md

@@ -32,12 +32,31 @@ Everything in the previous list is done — the original wording is in git histo
   window onto Easter — the search now covers four weeks either side instead of three
   days, and the advice is finally rendered. — `11f2a17`
 - **`dubbeldagar.md`** — answers the question, and corrects half of it.
+- **Every year of a repeating period is its own row**, linked by a series id, so one
+  year can differ from the rest — Easter moves, and the cheapest week is not the same
+  week every year. — `6d92b87`
+- **A day removed from a period stays removed**, across every later sync, with the
+  calendar marking it and offering to put it back. — `8cfb9c8`
+- **The e2e suite runs green**, 20 passed on three consecutive runs. It had never been
+  executed; the first run failed six ways because the test runner tripped the auth rate
+  limiter from a single address. — `e39ec9a`
 
 ## Open
 
-- **The e2e specs have not been run.** New Playwright coverage was written for the
+- **Rate limiting is keyed on the caller's address**, which behind a reverse proxy
-  uniform grid, the drag-to-create flow and the three-way remove, but no run has
+  without forwarded-header handling is the proxy's — so every user would share one
-  happened — `npm run e2e` from `frontend/` needs a real browser and a seeded backend.
+  30/minute refresh budget, and `AuthContext.tsx` turns a failed refresh into a silent
+  logout. The e2e suite hit exactly this. Two separable calls: which proxies to trust
+  for `X-Forwarded-For`, and whether a non-401 refresh failure should log someone out
+  or retry. The `catch` there has two identical branches, which reads unfinished.
+- **A removed day is never cleaned up.** Delete the whole period and the veto rows stay,
+  so a later period covering that date still skips it. Reachable only through that day's
+  popover; there is no list of them.
+- **Undo after an "every year" edit** restores the anchor's dates across the series
+  rather than each year's previous dates, so per-year divergence from before the edit is
+  lost. Would need a per-edit snapshot.
+- **`PLANNING_ENGINE_SPEC.md` §2.1/§3.2/§10.2 and parts of `ARCHITECTURE.md`** still
+  describe the single-row recurrence model that no longer exists.
 - **Dubbeldagar are not outside the 480.** `dubbeldagar.md` sets this out: the 60 are
   combined for the couple, as assumed, but each parent still spends one of their own
   days on a doubled date. Nothing in the engine changed on the strength of it — worth