fix: CommonMark rendering, home-path redaction, and the command guard cluster

.abcd/config/reading-presets.json

@@ -61,9 +61,9 @@
       ],
       "window": {
         "tokens_est": 1340000,
-        "measured_tokens_est": 1322032,
-        "measured_bytes": 5089824,
-        "measured_at": "b727b969a992532a9e67adb23734914a4f331513"
+        "measured_tokens_est": 1325292,
+        "measured_bytes": 5102376,
+        "measured_at": "0dd22bdc043952a36800be0d41d72ac65b23055d"
       }
     },
     "entailment": {
@@ -133,9 +133,9 @@
       ],
       "window": {
         "tokens_est": 390000,
-        "measured_tokens_est": 382812,
-        "measured_bytes": 1473830,
-        "measured_at": "b727b969a992532a9e67adb23734914a4f331513"
+        "measured_tokens_est": 383234,
+        "measured_bytes": 1475453,
+        "measured_at": "0dd22bdc043952a36800be0d41d72ac65b23055d"
       }
     },
     "comparative": {
@@ -217,9 +217,9 @@
       ],
       "window": {
         "tokens_est": 1350000,
-        "measured_tokens_est": 1331068,
-        "measured_bytes": 5124612,
-        "measured_at": "b727b969a992532a9e67adb23734914a4f331513"
+        "measured_tokens_est": 1334328,
+        "measured_bytes": 5137164,
+        "measured_at": "0dd22bdc043952a36800be0d41d72ac65b23055d"
       }
     }
   }

.abcd/development/brief/04-surfaces/02-disembark.md

@@ -86,6 +86,7 @@ INVENTORY (read-only)
 DESTINATION SAFETY GATE
   refuse unless <dest> is absent, empty, or carries a parseable _provenance.json
   → never overwrite a directory abcd did not produce (adr-35)
+  refuse a <dest> reached through a symlink at any level inside a checkout
                            │
                            ▼
 SECRET SCAN (before any write)

.abcd/development/brief/04-surfaces/03-embark.md

@@ -88,7 +88,10 @@ scaffolder and no model sit in the write path.
    specs — plus the report-only files that inform the run. The lifeboat is
    untrusted input: embark verifies its `manifest_sha256` against the on-disk
    tree, over every hashed file, and refuses a symlink or an oversize file
-   anywhere inside. A tampered hashed record or an added stray file is refused.
+   anywhere inside. Both operands, the lifeboat and the target, are refused
+   when they are reached through a symlink at any level inside a checkout, the
+   one place a commit can plant one; outside every checkout the path is the
+   operator's own and is taken as given. A tampered hashed record or an added stray file is refused.
    The post-pack synthesis layer sits outside the manifest seal deliberately,
    because it is written after the hash: those files carry their own per-entry
    integrity (cite-or-be-dropped, the registered-verdict gate) rather than the

.abcd/development/brief/04-surfaces/04-launch.md

@@ -584,7 +584,7 @@ fingerprinted — not the unversioned working tree.
   older harnesses fail to install it, and very old ones fail to load the
   marketplace. The install instructions and the release notes state the floor.
 - **Contributors** load the plugin from their own checkout rather than through a
-  second catalog entry (`CONTRIBUTING.md`).
+  second catalog entry (`.github/CONTRIBUTING.md`).
 
 **Anti-drift.** The two manifests in the artefact describe one release, so the
 version at the selected location and the marketplace entry must agree. A

.abcd/development/brief/04-surfaces/07-memory.md

@@ -44,11 +44,13 @@ surface contract: what the user types and what happens.
 
 **Bare `/abcd:memory`** renders the store's state and nothing else: how many
 pages there are by class, when the last ingest happened, the recent
-contradictions, and per-source quotation-budget headroom. It never mutates and
-never rebuilds an index. The JSON render carries one element the text render
-drops, a `drift` list saying that the catalogue or the contradictions register
-no longer hash-matches what the store's pages would render, so a reader knows
-the numbers are stale rather than wrong. Headroom is read-only in the same
+contradictions, per-source quotation-budget headroom, and drift. It never
+mutates and never rebuilds an index. Drift is a line saying that the catalogue
+or the contradictions register no longer hash-matches what the store's pages
+would render, naming the ingest as the verb that rebuilds it, so a reader
+knows the numbers are stale rather than wrong; the text board prints
+each line in the words the JSON's `drift` list carries, and a current store
+prints none. Headroom is read-only in the same
 spirit: a fresh index shows per-source warn and block headroom, a drifted one
 says to run the lint, and an absent or unreadable one says the headroom is
 unavailable rather than guessing at it.

.abcd/development/brief/04-surfaces/11-history.md

@@ -111,7 +111,9 @@ ahoy's registry stays under `~/.abcd/history/` and holds no transcripts.
 - **Reconstructing** — render one session, named by its id, as **one
   self-contained artefact** (`<session>.md`) and **one telemetry file**
   (`<session>.telemetry.json`), written into an output directory (default the working
-  directory) or to stdout. The artefact is Markdown because its
+  directory) or to stdout. The directory must already exist, and it is refused
+  when it is reached through a symlink at any level inside a checkout; outside
+  every checkout the path is the operator's own. The artefact is Markdown because its
   consumer is a model being handed the session as context; it names its records
   by basename and carries no store path, so it reads with the store gone.
 

.abcd/development/brief/04-surfaces/17-guard.md

@@ -260,7 +260,15 @@ command string handed to a shell is opened and read. A git alias declared on the
 command git would actually run is what gets checked. A commit or push that
 moves `core.hooksPath` for itself is read as skipping its hooks, which is what
 it does. A delete chained after `pushd` or `popd` is read as one chained after
-`cd`. In a repository with more
+`cd`. A `kill` handed what a process search prints, in a substitution or
+piped into `xargs kill`, is read as the kill by name it is — through a group
+and into one, whose every command is read as handed what is piped into it,
+through a shell string that runs the search, and into a shell string `xargs`
+runs or a pipe or redirect feeds, whose every command is read as handed its
+input — and a `pkill` or
+`killall` selecting by user, group or terminal, its value written apart or
+attached, as selecting every session under the account; `pkill`'s signal name
+is read as a signal first, in any case. In a repository with more
 than one worktree, a stash or pop that does not name its entry is warned about,
 because the stash stack is shared across worktrees. Where the reading is a
 guess, over-blocking is the direction the guard takes.
@@ -273,7 +281,9 @@ table does not name; a REST
 path an entry names by its root segment when the host serves that API under a
 prefix; an IFS the shell already holds when the line starts, or gains during the line
 through a name the guard does not read (`declare $(echo I)FS=x`, a sourced file),
-since every line is read from the default IFS; a payload inside a non-shell interpreter such as `python -c`, which is
+since every line is read from the default IFS; a pid list a kill reads through a variable or a file, or from a `ps |
+grep` chain;
+a payload inside a non-shell interpreter such as `python -c`, which is
 one opaque token and today a silent allow; and any dangerous form no entry
 describes. Nor does an allow see through a parameter expansion that carries no
 substitution (`$VAR`, `${VAR:-git}`), wherever it stands — as the command's

.abcd/development/brief/04-surfaces/20-banlist.md

@@ -76,7 +76,7 @@ markdown, with `exempt_paths` excusing a historical tree as it does under
 blocks, which the rest of the family skips by default: a fenced example is not
 prose, but a fence is published as readily as prose, so an entry that means to
 skip fences declares `skip_code_fences: true`. This repository's `name_roots` are `.abcd`, `AGENTS.md`,
-`CONTRIBUTING.md` and `scripts`, and its `exempt_paths` excuse the
+`.github/CONTRIBUTING.md` and `scripts`, and its `exempt_paths` excuse the
 configuration itself (whose entries spell every ban), the research data and the
 review archive.
 

.abcd/development/brief/04-surfaces/22-site.md

@@ -151,9 +151,10 @@ The build reads the repository and nothing else — no network at any point. Its
 inputs are the composition declaration and the interface-string allowlist; the
 record itself, read through the record-lint engine's own frontmatter scan so there
 is one parser rather than two; the bibliography and the glossary through their own
-parsers; one pass of git history; `CHANGELOG.md`; the two root prose files whose
-text the site publishes, which are the acknowledgements behind the references page
-and the authorship section of the contribution guide behind the contributors page;
+parsers; one pass of git history; `CHANGELOG.md`; the two prose files whose
+text the site publishes, which are the acknowledgements at the root behind the
+references page and the authorship section of the contribution guide in `.github/`
+behind the contributors page;
 and `docs/` with its committed assets. It writes the landing page, the record explorer, the machine-readable
 record export, the install script from its committed template, the redirect and
 header maps, the stylesheets and scripts, every referenced raster, and its own

.abcd/development/brief/04-surfaces/23-reading.md

@@ -142,6 +142,11 @@ contamination. And both artefacts are refused as input wherever an admitted path
 holds one, recognised by the type tag they carry, so a run committed before that
 refusal existed cannot ride in either.
 
+An output directory reached through a symlink at any level inside a checkout is
+refused however it is spelled (relative, absolute, or climbing out of the
+repository and back in), because a committed link would carry both files
+elsewhere; outside every checkout the path is the operator's own.
+
 Run identifiers are minted per adr-45, from a mint that reads no maximum, so two
 checkouts assembling in the same window cannot converge on one id.
 

.abcd/development/principles/adopt-contributor-commits.md

@@ -12,6 +12,6 @@ the same diff — a missing entry is a follow-up debt, not a separate decision.
 Surfaced by the second operator in the 2026-08-27 security-advisory pilot
 (F-W): the issue-sweep's re-author-with-`Reported-by` default cost a
 contributor with a ready branch their contributor-graph authorship. The
-enabling convention beneath this principle is `CONTRIBUTING.md`'s attribution
+enabling convention beneath this principle is `.github/CONTRIBUTING.md`'s attribution
 section; the discipline rung (a gate that notices an adopted-and-rewritten
 external branch) is unfiled.

.abcd/docs-lint.json

@@ -6,7 +6,7 @@
   "name_roots": [
     ".abcd",
     "AGENTS.md",
-    "CONTRIBUTING.md",
+    ".github/CONTRIBUTING.md",
     "scripts"
   ],
   "banned_tokens": [
@@ -257,10 +257,8 @@
       "severity": "blocker",
       "extra_roots": [
         "AGENTS.md",
-        "CONTRIBUTING.md",
         "CHANGELOG.md",
         "ACKNOWLEDGEMENTS.md",
-        "SECURITY.md",
         "RELEASE.md",
         ".abcd/README.md",
         ".github",
@@ -293,8 +291,6 @@
         "AGENTS",
         "CHANGELOG",
         "RELEASE",
-        "CONTRIBUTING",
-        "SECURITY",
         "LICENSE",
         "ACKNOWLEDGEMENTS"
       ]

.abcd/site.json

@@ -68,7 +68,7 @@
   "record_pages": {
     "contributors": {
       "policy": {
-        "file": "CONTRIBUTING.md",
+        "file": ".github/CONTRIBUTING.md",
         "heading": "AI assistance and authorship",
         "part": "first-bullet"
       }