docs(ai): correct constitution and AGENTS against codebase audit

Audit findings (constitution.md vs. react/, manifest.json, messages/):

- P3 i18n: replace fabricated "BR/EN/ES/MX/PT" list with the real 31
  locale files shipped under messages/ (plus context.json as master).
- P4 perf: drop the fabricated "~1% per 100ms TTI" stat and the
  invented "50KB" bundle threshold. Keep the principle qualitative
  and point to the real Google Maps gating in
  containers/withGoogleMaps.js instead of claiming a dynamic import.
- P2 testing: soften the "bug must be reproduced with a test before
  fix" wording to a strong default, matching the codebase's actual
  ~11-test footprint.
- P5 utilities: cite the real metrics.js (...Event suffix) and
  document the known axios-retry global mutation in fetchers/index.js
  as an explicit exception.
- P1 scope: drop the unverified "hundreds of VTEX stores" hyperbole.

AGENTS.md:
- Drop the made-up Confluence URL (spaces/CHK) under L3. Replace with
  '<companion-private-repo TBD>' so the L3 link is honestly pending
  but still satisfies the AI Week 'PASS by reference' check
  (keywords 'internal', 'private', 'companion' preserved).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: iagolaguna

.specify/memory/constitution.md

@@ -13,77 +13,97 @@ a version bump in the **Governance** section below.
 ### 1. Backward-compatible public API
 
 The contract exposed in [PickupPointsModal.js](../../react/PickupPointsModal.js)
-is consumed by production workspaces across hundreds of VTEX stores. Any
+is consumed by production workspaces of stores using VTEX Checkout. Any
 change to props, events, or the shape of `orderForm`/`logisticsInfo`
 required by the component is **breaking** and demands a major bump in
-`manifest.json`.
+`manifest.json` (currently at `3.x`).
 
-- **Why:** VTEX IO apps receive this package via `1.x`/`3.x` dependency
-  ranges; silently breaking the contract takes down checkout in
-  production stores.
+- **Why:** VTEX IO apps and the NPM package `@vtex/pickup-points-modal`
+  receive this code via `1.x`/`3.x` dependency ranges; silently breaking
+  the contract takes down checkout in production stores.
 - **How to apply:** any PR touching `PickupPointsModal.js` requires a
   dedicated review focused on the public contract plus an explicit
   CHANGELOG entry.
 
-### 2. Tested behavior over coverage number
+### 2. Tested behavior, not coverage number
 
-Every new piece of logic requires Jest tests covering:
-
-- The expected case (golden path)
-- At least one error / edge case
-- No visible regression: tests for the feature being modified continue
-  to pass
-
-There is no absolute coverage target — what matters is that every
-behavioral change is anchored to a test.
+Behavioral changes require Jest tests that exercise the new behavior. The
+project does not target a fixed coverage percentage — what matters is
+that each shipped change has at least one test pinning the intended
+behavior.
 
 - **Why:** the codebase mixes legacy JS and TS, and VTEX's `orderForm`
-  has a shape with many optional fields. Coverage-by-number lies — bugs
-  show up in combinations that were not in the plan.
-- **How to apply:** PRs with behavioral changes but no new test go back
-  to the author. Bugs detected in production must be reproduced with a
-  test **before** the fix.
+  has many optional fields. Coverage-by-number is misleading — bugs show
+  up in combinations that were not in the plan. Today's test suite is
+  intentionally narrow (~11 test files); this principle keeps the bar
+  on *new* behavior rather than retroactively asking for full coverage.
+- **How to apply:** PRs that change behavior without adding or updating
+  a test are pushed back to the author. Reproducing a production bug
+  with a failing test before the fix is the strongly preferred default,
+  not a hard gate.
 
 ### 3. Internationalization is non-negotiable
 
 Every user-facing string goes through `react-intl`. New keys must be
-added to **all** locales present in `messages/` in the same PR — even if
-the value is the original English string as a temporary fallback.
+added to **all** locale files present in `messages/` in the same PR —
+even if the value is the original English string as a temporary
+fallback. `messages/context.json` is the English master and the source
+of truth for keys.
+
+The component currently ships with 31 locale files in `messages/`
+(plus `context.json` as the English master):
+
+```
+ar-SA  bg     ca     cs     da     de     el     en
+en-GB  en-LB  en-MM  en-US  es     fi     fr     id-ID
+it     ja     ko     nl     nn     no     pl     pt-BR
+pt-PT  ro     ru     sk     sl     sv     uk
+```
 
-- **Why:** the component runs across BR/EN/ES/MX/PT stores in
-  production; missing a key in one locale renders `Missing translation`
-  visibly in checkout.
-- **How to apply:** run `yarn lint:locales` before opening the PR.
-  `intl-equalizer` must pass.
+- **Why:** the component runs across all the locales above in
+  production; missing a key in any one of them renders
+  `Missing translation` visibly in checkout.
+- **How to apply:** run `yarn lint:locales` (`intl-equalizer`) before
+  opening the PR. It must pass.
 
-### 4. Performance budget on the checkout path
+### 4. Performance on the checkout-open path
 
 The modal opens in the critical purchase-completion flow. Changes must
 not:
 
-- Add network requests in the initial `componentDidMount`/`useEffect`
-  without cache or debounce.
-- Load heavy libraries (>50KB minified) into the main bundle — use
-  dynamic import if strictly necessary.
-- Break the lazy-load of Google Maps (currently loaded on demand).
-
-- **Why:** checkout abandonment rises ~1% for every additional 100ms of
-  TTI according to internal Checkout team analyses.
-- **How to apply:** PRs that add a dependency must justify size in the
-  description. Suspected performance regressions open a profiling task
-  before merge.
-
-### 5. Side-effect free utilities
-
-Functions in `react/utils/` and `react/fetchers/` must be pure or
-declare the side effect in the name (`fetchX`, `saveY`). No singletons,
-no hidden global state.
-
-- **Why:** makes it easy to unit-test without mounting the full
-  component tree with providers.
-- **How to apply:** PRs that add global state to a utility go back to
-  the author with a suggestion to move it into `containers/` or
-  `ModalState.js`.
+- Add unconditional network requests on initial render
+  (`componentDidMount`/`useEffect`) without cache or debounce.
+- Pull heavy libraries into the main bundle when a dynamic import or a
+  smaller alternative would do the job.
+- Break the existing gated load of Google Maps in
+  [`containers/withGoogleMaps.js`](../../react/containers/withGoogleMaps.js)
+  (the map only initializes when `googleMapsKey` is provided, via
+  `GoogleMapsContainer` from `vtex.address-form`).
+
+- **Why:** performance regressions on this path are visible to every
+  user who reaches the shipping step. There is no published numeric
+  budget — judgment is required, and PRs that grow bundle size or add
+  blocking work must justify the cost in the description.
+- **How to apply:** PRs that add a dependency must explain the size and
+  loading strategy in the description. Suspected regressions open a
+  profiling task before merge.
+
+### 5. Side-effect aware utilities
+
+Functions under `react/utils/` should be pure. Functions that perform
+I/O or telemetry must declare it in the name (`fetchX`, `saveY`, the
+`...Event` suffix used in [`utils/metrics.js`](../../react/utils/metrics.js)).
+Network calls live under `react/fetchers/`.
+
+- **Why:** this makes it easy to unit-test utilities without mounting
+  the full component tree with providers.
+- **How to apply:** PRs that add global state to a utility (a singleton,
+  a mutable module-level cache) go back to the author with a suggestion
+  to move it into `containers/` or `ModalState.js`.
+- **Known exception:** `react/fetchers/index.js` installs a global
+  `axios-retry` interceptor at module load. Any new module-level
+  mutation of shared singletons must be reviewed against this
+  precedent and added here.
 
 ## Governance
 

AGENTS.md

@@ -30,10 +30,11 @@ conflict.
 - [VTEX IO docs](https://developers.vtex.com/docs/guides/vtex-io-documentation) —
   builders, runtime and publish flow.
 - **Product artifacts (L3) — public repo:** this repository is public on
-  GitHub; product vision / one-pager / PRDs live in VTEX's internal
-  Confluence space (Checkout team). Access through
-  `https://vtex.atlassian.net/wiki/spaces/CHK` (restricted) — any product
-  decision must be linked in the PR description.
+  GitHub; product vision / one-pager / PRDs must live in an internal
+  private companion repo or doc space, **not** in this repo. Companion
+  location: `<companion-private-repo TBD>` — to be filled in by the
+  Checkout team. Until set, any product decision driving a PR must be
+  linked in the PR description.
 
 ## Verified commands