D0-R: repair ADR numbering and enforce reference integrity

[aurascoper]

head:  89c04e1                     # merge-forward; 1088fd9 remains an ancestor
base:  main@622f640
lane:  D0-R  (prerequisite; blocks D0 → A0/A → B)
files: 11    (8 modified, 2 added, 1 rename)
dispositions: 13 / 3 / 3 / 2

Updated onto current main

main moved to 622f640 (README rewrite) after this branch cut from d0f3867,
leaving the PR non-mergeable. Merged rather than rebased, so 1088fd9 remains
an ancestor exactly as reviewed and the update is one transparent commit.

The only conflict was the root README.md, resolved by accepting current
main wholesale. That rewrite deleted the embedding-ADR link entirely, so
D0-R's edit to it is no longer needed: README.md now has no net diff against
main and has left the effective PR diff — 12 files → 11.

Dispositions drop 14 / 3 / 3 / 2 → 13 / 3 / 3 / 2. The reduction is real:
one fewer reference exists to repoint. No replacement citation was manufactured
to preserve the old count.

Re-verified against the post-merge tree — checker, its 16 tests, the full
fixture matrix, swift build, and the deterministic Swift selection all pass.

Why

CONTRIBUTING.md makes docs/architecture/decision-log/ canonical, so an ADR reference resolving to no file — or to two — is a provenance defect, not a typo.

ADR-004 has been double-assigned for a year. ROADMAP.md recorded it, the 2026-07-19 review re-found it as finding M6, and neither caused the fix. It survived because the codebase routed around it: the embedding ADR tells reviewers to cite it by section, so 12 citations carried a §-marker that disambiguated what the number could not.

Dispositions — all 21 references, none ambiguous

n	disposition	what
13	→ ADR-010	8 §-marked code/test citations, the ADR's heading + 3 self-citation examples, embedding_contract.md
3	stay ADR-004	privacy ADR's heading; ADR-005 and ADR-008, which already cite by full filename
3	rewritten	ROADMAP.md — it documented the defect and is now obsolete
2	preserved	docs/reviews/ historical findings, left as written

The review's "renumber to ADR-009+" is deliberately not honoured: 009 is claimed by 22 live citations in the generation-runtime layer, so the embedding contract takes 010. Numeric gaps are legal and the checker asserts it.

The gate ships with the repair

Otherwise it red-lights the branch introducing it. Two modes — hard fails on normative roots (Sources/, Tests/, Scripts/, docs/architecture/); advisory reports historical prose without failing. Without that split, excluding docs/reviews/ and requiring failure because of its ADR-009+ line is a contradiction.

hard      / unmodified   FAIL  1 error (duplicate), and only that
hard      / repaired     PASS  0 warnings
advisory  / unmodified   PASS  2 warnings
all       / unmodified   FAIL  1 error + 1 warning
all       / repaired     PASS  1 warning (historical, preserved)

python3 Tests/eval/test_adr_references.py   16 tests, OK
swift build                                 OK
deterministic suites                        287 executed, 3 skipped, 0 failures
git diff --check                            clean

Stdlib-only, run as a direct python3 step in the existing macOS job — main has no Python job, so a Tests/eval/*.py file would otherwise execute nowhere. Tests run before the checker: a gate whose only evidence is that it never complained is not a gate.

Two traps found by executing the repair

Both now pinned as tests. A §-marked sed pass leaves a markdown link naming the old filename. And a resolution note announcing "ADR-009 is reserved…" fails the very gate it announces, since that ADR does not exist yet — the ROADMAP wording names the reserved number without emitting a canonical token.

Base note

Branched from origin/main, not the PR #32 merge commit. That merge carried 22 dangling ADR-009 citations onto staging; they resolve to the runtime-semantics ADR that A0 reconstructs, so the hard gate cannot pass there until lane A lands. On main the only defect is the duplicate. The gate then blocks lane A from landing those citations without their document — which was the intent.

Not in scope: Mirror observability, event timestamp/build identity, the Ollama promptProfile: custom cleanup, sustained mode-fidelity work.