docs: close the PR #135 documentation review findings

Group 3 of the validated PR #135 review fixes. Every figure and commit
citation below was re-verified at HEAD before being written.

ADR and architecture:
- #7 ADR-0025 cited 61b0b9c, which no published branch reaches. Repointed
  to 620f20b (identical parent tree, reachable from the PR branch), with a
  note that neither is reachable from origin/main. The parser-drift
  paragraph now credits 598a7c3 (the reachable PR #129 squash) and keeps
  484357a only as a pre-squash parenthetical.
- #8 architecture.md dropped the pointer at the LESSONS.md entry this
  branch deleted.
- #9 architecture.md's ADR entry points now name ADR-0015 (the one
  compiler) and ADR-0024, and list ADR-0024 as superseding ADR-0017.
- #10 ADR-0024 section 4 rewritten: the standing patch-bump rule is
  apm-workflow's configure.md, not ADR-0006's, and this change does not
  trigger it. ADR-0015:93 carries a correction for the misattribution.
- N5 ADR-0021 gained a Correction note for the deleted
  scripts/check-manifests.sh (e647f14).

gates.md:
- #11a the four ADR-0020 constants live in lib-checks-skill.sh:313-316 and
  lib-checks-agent.sh:164-165, not in validate.sh.
- #11b the pretty-format-json exclude is two alternations expanding to
  three tracked files, including .claude/apm-hooks.json.
- #11c the ADR-0020 contract suite runs 28 -> 27 -> 29 (620f20b,
  4de5b6b, ef27c97), 29 at HEAD; the unverifiable 25 is dropped.
- #11d the boundary resolver is one copy since ef27c97.
- #12 apm-audit-ci documents the 10 root checks and the 1 plugin check
  apm 0.28.0 actually runs, that content-integrity IS the hidden-Unicode
  scan, that manifest-parse is not a named check, and that the hook needs
  a completed apm install. The offline claim is qualified accordingly.
- N9 gates.md:142-146 verified to still match the hook description.

AGENTS.md:
- #12 the no-network session rule is qualified to a populated
  apm_modules/.

Audit note:
- A1 hook counts corrected to 27/9 -> 26/8 -> 27/9 -> 26/8 (26 and 8 at
  HEAD) and the dangling pointer dropped.
- A2 skill-size-check.sh is 509 lines with the resolver sourced, not 1,522
  embedded; citations repointed to skill-size-check.sh:323-335 and
  lib-checks-skill.sh:235-283 (fail() at :265 and :280), and that library
  is 627 lines.
- A3 consumers receive 15 test files across 5 skills; 16 tracked test
  paths repo-wide.
- A4 the "do not run apm update on this branch" instruction is marked
  superseded, with the branch-aware guidance in its place.
- Finding 31's "true orphans" claim corrected for HOTL and Sycophancy,
  both still used in core/ai-constitution.md.

Same class, found during group 2:
- skill-author's deployment-modes.md no longer points at .mcp.json
  configs (deleted in c96ca9c); metadata.version 1.0.2 -> 1.0.3.
- git-orchestrate's context contract clarifies that
  user_config_overrides is caller-supplied session state, not a config
  read. The field name is unchanged.
- B3 root apm.yml's executables.allow comment: grants are version-blind
  in apm 0.28.0, so the #2.0.0 suffix is cosmetic to apm and a bump does
  not break the hook; the suffix stays because
  check-executables-allow-sync.sh requires it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NwD8Egs5r4ndqeFLmhusX2

docs/adr/0015-apm-replaces-plugin-marketplace-authoring.md

@@ -93,6 +93,13 @@ correction) sorted what they document into three buckets:
   because of hand-authored dual manifests (ADR-0006's version-parity/patch-bump rule, the
   CC-vs-Copilot field-placement split, dual-file mirroring) are obsolete under `apm.yml`'s
   single-manifest model and were deliberately dropped.
+  > **Correction (2026-09-19):** "ADR-0006's version-parity/patch-bump rule" misattributes the
+  > patch-bump half. ADR-0006 states a version-*parity* rule and nothing about patch bumps — the
+  > string `patch` does not appear in it (`git show origin/main:docs/adr/0006-plugin-version-parity.md`).
+  > Only the parity half was ADR-0006's, and only that half was dropped. A patch-bump rule does
+  > exist and is live: `plugins/kyberforge/.apm/skills/apm-workflow/references/configure.md` —
+  > bump a package's own `apm.yml` `version:` whenever anything reaching its compiled output
+  > changes. ADR-0024 §4 repeated this misattribution and is corrected there too.
 - **Holocron policy choice — resolved in #90.** `marketplace-author`'s catalog-version convention
   (minor bump for package add/remove, patch bump for field-only updates) isn't an APM mechanic —
   `apm` doesn't enforce it, and has no native version-bump automation at all — so rather than

docs/adr/0021-plugin-descriptions-state-a-domain-boundary.md

@@ -85,7 +85,15 @@ unnamed in `git`'s corrected description, though `65bac15`'s own commit message
 `gitea`'s. Across the three plugins, 23 of 27 skills are named at the third attempt.
 
 **Nothing checks any of this.** `scripts/check-manifests.sh` does not contain the string
-`description`. The three ADR-0020 validators (`scripts/skill-size-check.sh` and skill-audit's and
+`description`.
+
+**Correction (2026-09-19): that script no longer exists.** `e647f14` deleted
+`scripts/check-manifests.sh` (282 lines), `tests/test-check-manifests.sh` (771 lines) and the
+`check-manifests` pre-commit hook entry with them. The conclusion is unchanged and now holds a
+fortiori: the gate that did not read `description:` is gone, so nothing in its place reads it
+either.
+
+The three ADR-0020 validators (`scripts/skill-size-check.sh` and skill-audit's and
 agent-audit's `validate.sh` — two since ADR-0025 merged the audit pair into `factory-audit`, whose
 single auto-detecting `validate.sh` carries both) gate on SKILL.md and agent frontmatter; they do open `apm.yml`, but only
 to read `dependencies.apm` when resolving the boundary-target universe — none of them reads the

docs/adr/0024-apm-is-the-only-supported-install-path.md

@@ -179,14 +179,15 @@ now discoverable in the install output and would otherwise be found and double-r
 they do not belong to — exactly the `apm_modules/` problem ADR-0018 recorded, arriving by a second
 route. Any future script that walks this repo's tree needs both exclusions.
 
-**4. No version bumps.** There is no standing rule that would require one. The patch-bump-on-content-
-change convention this repo once followed was ADR-0006's, and ADR-0015 explicitly retired it as a
-dual-manifest artifact: "Conventions that existed only because of hand-authored dual manifests
-(ADR-0006's version-parity/patch-bump rule …) are obsolete under `apm.yml`'s single-manifest model
-and were deliberately dropped." ADR-0015 also records that apm "has no native version-bump
-automation at all", so nothing mechanical demands one either. What remains is the substantive test,
-and it is satisfied independently: nothing under `.apm/` is touched here, only compiled artifacts are
-removed, so the content every apm consumer receives is byte-identical before and after. This also
+**4. No version bumps.** There *is* a standing rule, and it is not triggered here.
+`plugins/kyberforge/.apm/skills/apm-workflow/references/configure.md` states it: **bump a package's
+own `apm.yml` `version:` whenever anything that reaches its compiled output changes** — either its
+`.apm/` content (a new or removed skill/agent/hook, or a substantive edit to one) or its own
+manifest metadata (`description`, `keywords`, `author`, `license`, `homepage`, `repository`, all
+compiled verbatim into `plugin.json`). This change touches neither: nothing under `.apm/` is edited,
+no manifest metadata changes, and only compiled artifacts are removed, so the content every apm
+consumer receives is byte-identical before and after. apm also "has no native version-bump
+automation at all" (ADR-0015), so nothing mechanical demands one either. This also
 avoids triggering the `executables.allow`
 `kyberforge#<version>` pin cascade ADR-0019 describes, which would otherwise turn a cleanup into a
 multi-file coordinated edit for no functional gain.

docs/adr/0025-skill-audit-and-agent-audit-merge-into-factory-audit.md

@@ -46,9 +46,16 @@ On top of that, `scripts/check-vale-style-sync.sh` (413 lines) and
 gate was a copy diff**; it was not, and saying so would overstate the case for deleting it. The
 script has **17 assertion sites**: 13 `err` calls and 4 hard-fail exits. Its closing
 `exit 1` only reports the `err` count, so it is not an assertion. Count them with
-`git show 61b0b9c^:scripts/check-vale-style-sync.sh`. An earlier revision of this ADR said 18. No
+`git show 620f20b^:scripts/check-vale-style-sync.sh`. An earlier revision of this ADR said 18. No
 reproducible counting rule gives 18, and it is corrected here.
 
+> **Repointed (2026-09-19):** this ADR originally cited `61b0b9c^`. `61b0b9c` is a pre-squash commit
+> that no published branch reaches, so the `git show` failed for anyone but its author. `620f20b` is
+> the reachable squash of the same work on `docs/simplification-audit`, and `61b0b9c^` and `620f20b^`
+> have identical trees (`git diff 61b0b9c^ 620f20b^` is empty), so every figure taken at the old
+> parent reproduces at the new one. Note that `620f20b` is not reachable from `origin/main` either —
+> fetch the PR branch (`git fetch origin docs/simplification-audit`) before running the command.
+
 | Class | Old line | What it asserted | Now |
 |---|---|---|---|
 | **Moot (6)** | 19 | `REPO_ROOT` is a directory | nothing to guard; no script |
@@ -217,10 +224,13 @@ it stops pinning that two `validate-provenance.sh` copies of the Contributing-fi
 byte-identical, and starts pinning that `lib-contributing-files.sh` is a single sourced copy that has
 not been re-inlined into either mode library. The claim it protects is the same one — the parser has
 exactly one authority — stated against the new structure. The drift history behind it is smaller than
-an earlier revision of this ADR implied. `484357a` (2026-08-30) added the bullet-form parser to both
-copies with two different spellings of the loop: a temporary `rest` in skill-audit and an inline
-slice in agent-audit. The two were behaviourally identical. `598a7c3` (2026-09-01) unified the
-spellings and added the `SHARED CONTRIBUTING-FILES PARSER` markers that 1b hashed. From then until
+an earlier revision of this ADR implied. `598a7c3` (2026-09-01, the squash of PR #129) is where the
+bullet-form parser landed on a published branch, in both copies, already carrying the
+`SHARED CONTRIBUTING-FILES PARSER` markers that 1b hashed. The drift it is named for happened inside
+that PR's own history: `484357a` (2026-08-30, pre-squash, not on any published branch) added the
+parser with two different spellings of the loop — a temporary `rest` in skill-audit and an inline
+slice in agent-audit — which were behaviourally identical, and a later commit on the same branch
+unified the spellings before the squash. From then until
 the merge's parent the two marker blocks were byte-identical (`md5 0857272d…` both). So the parser
 never *parsed* differently. What the gate never covered was the prose around the block, and a
 docstring there asserted identity the loop did not have. One sourced library removes the question.
@@ -388,7 +398,8 @@ so the correction is not re-derived from scratch later.**
   description content rather than accumulating it: the `Not a skill directory -> skill-audit` clause
   loses its referent, and the `"is this ready to ship"` trigger was duplicated verbatim across both.
   The two descriptions it replaces measure **239** (skill-audit) and **250** (agent-audit) at
-  `61b0b9c^`. The description this skill ships measures **241**, inside the 250 SUGGESTION target.
+  `620f20b^` (see the repointing note above). The description this skill ships measures **241**,
+  inside the 250 SUGGESTION target.
   It carries one arrow per boundary target (`Not applying skill fixes -> skill-author. Not applying
   agent fixes -> agent-author.`), because ADR-0020 resolves only the first target after an arrow, so
   a one-arrow form would leave `agent-author` checked by nothing. The real blocker was the body: 1,532