docs(reorg): standards tidy-up deep dive, 220 issue dispositions, bot plan; fix four reds

.github/workflows/readme-derive-reusable.yml

@@ -35,10 +35,10 @@ permissions:
   actions: read
   contents: read
 
-# Read-only check workflow — safe to cancel superseded runs.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+# No concurrency block here on purpose. Inside a called workflow github.workflow
+# resolves to the CALLER's name, so a group declared on both sides collides and
+# the run cancels itself before any job starts (README Derive: 0 jobs on every
+# main run from 2026-07-28 to 2026-10-13). Callers own concurrency.
 
 jobs:
   derive-readme:

.machine_readable/Debtfile.a2ml

@@ -48,16 +48,6 @@ forgotten.
 
 ## Hygiene
 
-### shell-scripts-missing-spdx
-- description: Shell scripts under scripts/ without an SPDX-License-Identifier in the first three lines
-- probe: n=0; for f in $(git ls-files 'scripts/*.sh'); do head -3 "$f" | grep -q 'SPDX-License-Identifier' || n=$((n+1)); done; echo "$n"
-- count: 0
-- ceiling: 1
-- severity: medium
-- policy: remediable
-- tri: eliminate
-- accepted-until: 2026-10-01
-
 ### todo-fixme-markers
 - description: Files carrying a TODO or FIXME marker. Advisory — a marker is a note to self, not a defect Re-baselined 2026-09-22 (round 2, issue #953): fossilized at 77, measured 80. Probe corrected 2026-10-06: `*.ncl.in` templates are excluded, because their `TODO` fields are placeholders by design (copy, then fill in every TODO), not notes to self; measured 84.
 - probe: git grep -I -l -E '\b(TODO|FIXME)\b' -- . ':(exclude).machine_readable/Debtfile.a2ml' ':(exclude)docs/DEBTFILE-SPEC.adoc' ':(exclude)*.ncl.in' | wc -l

Justfile

@@ -133,14 +133,15 @@ validate:
 # Print role-appropriate LLM warm-up context (machine front door)
 llm-context role="dev":
     @echo "# Front door: 0-AI-MANIFEST.a2ml (machine) + README.adoc (human)"
-    @cat "llm-warmup-{{role}}.md" 2>/dev/null || cat 0-AI-MANIFEST.a2ml
+    @cat "llm-warmup-{{role}}.adoc" 2>/dev/null || cat 0-AI-MANIFEST.a2ml
 
-# Build all sub-project artefacts
+# Build all sub-project artefacts. The canon ships specs, not products: the k9
+# Rust binding moved to hyperpolymath/k9-ecosystem (#491) and the groove ipv6t
+# reference is not in this tree, so there is nothing to compile here. Kept as a
+# recipe so `just build` stays a valid estate entry point (and says so).
 build:
     @echo "=== Standards Monorepo Build ==="
-    @echo "[2/3] k9 Rust binding — moved to hyperpolymath/k9-ecosystem (rs/) under #491"
-    @echo "[3/3] 2-protocols/groove/reference/ipv6t"
-    @cd 2-protocols/groove/reference/ipv6t && zig build 2>&1 || echo "  SKIP: zig not available"
+    @echo "nothing to build: specs only (k9 binding -> hyperpolymath/k9-ecosystem, #491)"
     @echo "=== Build complete ==="
 
 # Run all sub-project test suites
@@ -160,17 +161,14 @@ fmt:
     @echo "=== Standards Monorepo Format ==="
     @echo "=== Format complete ==="
 
-# Lint sub-projects
-lint:
-    @echo "=== Standards Monorepo Lint ==="
-    @echo "[1/2] Rust clippy"
-    @echo "[2/2] Deno lint"
-    @echo "=== Lint complete ==="
+# Lint. The repo's lint surface is the structural gates, not a per-language
+# linter run (there is no root crate; Deno is banned). Delegates to `validate`.
+lint: validate
 
 # Clean build artifacts
 clean:
     @echo "=== Cleaning ==="
-    @cd 2-protocols/groove/reference/ipv6t && rm -rf zig-out zig-cache .zig-cache 2>/dev/null || true
+    @rm -rf .cache/stale 2>/dev/null || true
     @echo "=== Clean complete ==="
 
 # Run panic-attacker pre-commit scan
@@ -179,7 +177,7 @@ assail:
 
 # Stable release gate audit
 v1-audit path=".":
-    @./release-pre-flight/v1-audit.sh "{{path}}"
+    @bash 3-practice/release-pre-flight/v1-audit.sh "{{path}}"
 
 # Self-diagnostic — checks dependencies, permissions, paths
 doctor: