fix(docs): correct claims the first fix round asserted without measuring

Why: two blind verifiers re-ran the five preceding commits and found four
defects of the same class this branch exists to close -- a confidently stated
measured claim that does not survive re-measurement -- this time inside the
fixes themselves.

- AGENTS.md:41 still carried both phrasings c68e864 reports having corrected.
  `grep -rn repo-defined` returned exactly one hit repo-wide: that line, in the
  file every session preloads. 4d336bb edited the line directly above it.
- ADR-0021 asserted twice, in the section justifying that no gate is added,
  that the ADR-0020 validators "never open an apm.yml". All three open and
  yaml.safe_load it (skill-size-check.sh:342, both validate.sh). The conclusion
  survives -- none reads the description: key, and their globs are SKILL.md and
  *.agent.md only -- but the stated mechanism is falsified by one grep.
- architecture.md said the ADR directory holds 20 numbered ADRs; c7ba3d2 made
  it 21, and c68e864 audited that file for exactly this class of stale count.
  The number is dropped rather than corrected: `ls docs/adr/` is already the
  index, so a count in prose is a second thing to maintain.
- gates.md's new three-verdict table said `-> name` promotes an unresolved
  target to ERROR. Reproduced with fixtures: NAME_HYPH (skill-size-check.sh:543)
  requires a hyphen, so `-> gitea-prs` is checked and `-> triage` is not
  extracted at all, and the unicode arrow is never recognised. The SUGGESTION
  text advises that spelling, so taking its advice can silence the finding. The
  gap is now documented as a defect; nothing covers it, since the one arrow case
  in test-adr0020-targets.sh happens to use a hyphenated target.

Implementation notes:
- AGENTS.md:48's coverage claim is shrunk rather than chased. Restoring six
  glossary entries did not make it true: 12 more sampled terms are undefined,
  three of them (trigger/capability/boundary clause) used inside CONTEXT.md
  itself. It now says CONTEXT.md is the glossary and is not exhaustive.
- CONTEXT.md's output profile and near-miss entries are corrected against their
  sources. The first stated a false exclusion -- .github/plugin/plugin.json IS
  apm-generated; only the marketplace mirror has no profile. The second
  inverted its source's referent: description-quality.md defines a near-miss as
  a query, not a sibling skill.
- The strict-mode message named jq, which no suite guards on (`command -v jq`
  appears nowhere in tests/), while omitting python3/PyYAML, which three do.
- README's git and gitea bullets now name git-workflow and gitea-workflow.
  ADR-0021 leaves README the only inventory and architecture.md now points at
  it, so the two bullets that were short had to be completed.
- ADR-0018's 2026-08-14 correction is marked superseded in place. It asserted
  machine state in the present tense that its own 2026-08-17 note retracts.
- ADR-0021's remaining errors: six files -> four (measured from de84d1b), the
  wiki description's length 114 -> 96 chars, the codex self-contradiction, the
  cost argument overstating bumps already owed for any skill addition, and two
  claims about files this branch went on to edit.
- The "15 of 17 suites" figure is restored where I had removed it: it is a dated
  record of one incident, not a live count, and four sites now describe it the
  same way.

Impact: 16/16 pre-push hooks pass, suite 24 passed 0 skipped 0 failed. No
behaviour change; every edit is prose or a comment.

Refs: #105

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TmFqzpuExLJv3m114XVE9w

docs/adr/0021-plugin-descriptions-state-a-domain-boundary.md

@@ -11,10 +11,11 @@ plugin is *for*, and the inventory lives where an inventory can be read off the
 ## Context
 
 A plugin's published description is one string authored twice — in `plugins/<name>/apm.yml` and in
-the matching `marketplace.packages[]` entry of the root `apm.yml` — and compiled into six files per
-plugin edit: `.claude-plugin/plugin.json`, `.github/plugin/plugin.json`,
-`.claude-plugin/marketplace.json`, `.github/plugin/marketplace.json`, and (for the version field
-only) their codex counterpart. It is the only text a consumer sees in a marketplace listing before
+the matching `marketplace.packages[]` entry of the root `apm.yml` — and compiled into four generated
+files per plugin edit: the plugin's `.claude-plugin/plugin.json` and `.github/plugin/plugin.json`,
+plus the repo-wide `.claude-plugin/marketplace.json` and its `.github/plugin/marketplace.json`
+mirror. (`.agents/plugins/marketplace.json`, apm's codex profile, carries no per-package
+`description` or `version` at all and is unaffected.) It is the only text a consumer sees in a marketplace listing before
 installing. It is **not** a SKILL.md `description`: it is never preloaded into an agent's context and
 routes nothing at runtime. ADR-0020 governs that other artifact; this one governs this one. The
 overlap is a finding, not a scope: ADR-0020 established that capability enumeration in a description
@@ -70,17 +71,21 @@ unnamed in `git`'s corrected description, though `65bac15`'s own commit message
 `gitea`'s. Across the three plugins, 23 of 27 skills are named at the third attempt.
 
 **Nothing checks any of this.** `scripts/check-manifests.sh` does not contain the string
-`description`. `scripts/skill-size-check.sh` and the three ADR-0020 validators read SKILL.md and
-agent frontmatter and never open an `apm.yml`. `apm audit --ci`, `apm pack --check-clean` and
-`scripts/sync-plugin-content.sh --check --all` all compare compiled output against `apm.yml`, so
-their entire job is to propagate whatever the description says into six files byte-for-byte and
-confirm they match. The `wiki` claim passed every one of the fourteen pre-push hooks, every day it
+`description`. The three ADR-0020 validators (`scripts/skill-size-check.sh` and skill-audit's and
+agent-audit's `validate.sh`) gate on SKILL.md and agent frontmatter; they do open `apm.yml`, but only
+to read `dependencies.apm` when resolving the boundary-target universe — none of them reads the
+`description:` key, and their hook globs match `SKILL.md` and `*.agent.md` only. `apm audit --ci`,
+`apm pack --check-clean` and `scripts/sync-plugin-content.sh --check --all` all compare compiled
+output against `apm.yml`, so their entire job is to propagate whatever the description says into
+those four files byte-for-byte and confirm they match. The `wiki` claim passed every one of the fourteen pre-push hooks, every day it
 was published.
 
 **And the obligation is unbounded.** Under enumeration, adding one skill to `bin`, `git` or `gitea`
-means editing two copies of a prose string, a PATCH bump on the package, a bump on
-`marketplace.version`, and a regeneration of eight compiled files — a marketplace release, triggered
-by a directory appearing. A skill *rename* triggers the same. 27 of the repo's 39 skills sat behind
+means editing two copies of a prose string on top of the version bumps and regeneration any skill
+addition already owes under this repo's release policy
+(`plugins/kyberforge/.apm/skills/apm-workflow/references/marketplace.md`). The bumps are not the
+marginal cost — the prose edit is, and it is the half nothing checks. A skill *rename* triggers the
+same, for a string no consumer can tell went stale. 27 of the repo's 39 skills sat behind
 a description carrying that obligation; the other 12 did not, and their three plugins have generated
 no defect of this class.
 
@@ -159,7 +164,7 @@ fresh and two prior commits as precedent, is four skills unnamed.
 
 **Cap the description length**, mirroring ADR-0020's 250/400-character tiers, on the theory that a
 short description has no room to enumerate. Rejected because length does not measure correspondence:
-`gitea`'s failing description was 114 characters and asserted a skill that has never existed, while
+`gitea`'s failing description was 96 characters and asserted a skill that has never existed, while
 `bin`'s 176-character enumeration is under the same cap. All six descriptions here, before and after,
 sit inside ADR-0020's tiers; the tier would have been silent through all three failures.
 
@@ -183,11 +188,12 @@ field at all, only `name`, `source`, `policy` and `category`.
 1.3.5, `gitea` 1.3.5 → 1.3.6, `marketplace.version` 0.4.4 → 0.4.5.
 
 **The root `apm.yml` top-level `version:` is restored to lockstep with `marketplace.version`,
-0.4.2 → 0.4.5.** These two fields have moved together in every one of the eleven commits that have
-ever touched root `apm.yml` — 0.3.2, 0.3.3, 0.3.4, 0.4.0, 0.4.1, 0.4.2 in both — until `65bac15` and
+0.4.2 → 0.4.5.** These two fields have moved together in every commit that has ever touched root
+`apm.yml` — 0.3.2, 0.3.3, 0.3.4, 0.4.0, 0.4.1, 0.4.2 in both — until `65bac15` and
 `de84d1b` on this branch bumped `marketplace.version` to 0.4.3 and then 0.4.4 while leaving the
-top-level field at 0.4.2. This is a defect, not a style: `apm.yml`'s own comment above the
-marketplace block records that the top-level `version:` is not inherited into the compiled output
+top-level field at 0.4.2. Lockstep is not folklore: it is stated at
+`plugins/kyberforge/.apm/skills/apm-workflow/references/marketplace.md`. This is a defect, not a
+style: `apm.yml`'s comment inside the marketplace block records that the top-level `version:` is not inherited into the compiled output
 "despite being used elsewhere (e.g. by `apm audit`)", so the field is live and was silently two
 releases behind what the marketplace published. Closed here rather than tracked, because the
 correction is one line and the drift is three days old.
@@ -199,13 +205,14 @@ duplication to collapse — they have different readers and different lifecycles
 says so in its own preamble ("These are routing boundaries, not inventories"). One caveat for whoever
 next edits that page: its closing sentence sends a reader to the published description "for what a
 consumer actually gets", which was true against an enumeration and is now a pointer to a second
-boundary statement. Neither artifact carries an inventory after this change. That sentence is owned
-by a separate workstream in this change and is deliberately not edited here.
+boundary statement. Neither artifact carries an inventory after this change, so that sentence was
+rewritten in the same branch to point at `plugins/<name>/.apm/skills/` and `README.md` instead.
 
 **`README.md`'s plugin bullet list becomes the only place an inventory lives, and it still
-enumerates.** Its `bin` and `git` bullets mirror the retired descriptions almost verbatim. This ADR
-does not extend to it and does not require it to change: a README is a hand-read document where a
-list of what you get is the useful thing, it is not compiled into six files, and a stale line in it
+enumerates.** That is deliberate, but it makes the list load-bearing in a way it was not before, so
+its `bin`, `git` and `gitea` bullets were completed in the same branch to name every skill those
+plugins ship. This ADR does not otherwise extend to it: a README is a hand-read document where a
+list of what you get is the useful thing, it is not compiled into four files, and a stale line in it
 costs a reader a moment rather than misrepresenting a published package. The tradeoff that makes
 enumeration wrong in a marketplace manifest is precisely the one that makes it fine there.