feat: ground open-questions, naming and internals at the conventions tier (itd-95, itd-96)

[REPPL]

Lands both conventions-tier adapter intents together. Rolls up the reviewed and merged #124 (itd-95) and #126 (itd-96); this PR carries no new work of its own.

ID collision with the concurrent programme, resolved

Both this programme and the derived-versioning programme minted spc-10/spc-11 on the same day from branches cut off the same base, and both minted iss-110. abcd mints the next free id from the local tree, so concurrent branches always take the same number and neither can see it.

The spec collision breaks the bidirectional intent-spec link in both directions at once — whichever spec wins the store lookup leaves the other intent's link dangling, so on the naively merged tree abcd intent ready failed for both itd-95 and itd-67. The other programme's ids are already on main, so this branch renumbered: spc-10 -> spc-12 (itd-95), spc-11 -> spc-13 (itd-96), iss-110 -> iss-116. All four affected intents (itd-95, itd-96, itd-67, itd-73) now report READY on the merged tree.

The issue collision was caught automatically by record-lint's issue_id_unique blocker at the push gate; the spec collision was not, because specs have no equivalent lint — iss-115 captures that gap.

The commit messages and PR bodies of #124 and #126 still name the old ids. That history was accurate when written and is left alone.

Resolves ledger issues iss-99 and iss-100 (.abcd/work/issues/open/) — this repository tracks issues in the record, not on GitHub.

What lands

Three brief sections that blanked on any repository without an .abcd/ record now ground from the repository's own files:

• evidence/open-questions (itd-95) — a marker scan citing path:line for TODO, FIXME, XXX, HACK, BUG.
• constraints/naming (itd-96) — a dedicated naming document, falling back to the glossary with an explicit qualifier at lower confidence.
• internals (itd-96) — architecture prose plus a package-layout scan.

Plus SourceContext.WalkFiles, the bounded recursive walk the probe lacked, mirroring embark.go's existing fs.WalkDir(root.FS(), …) rather than adding a second traversal idiom.

All three ceiling at StatusPartial, matching what each mapping row already predicts for the conventions tier, so mapping.go — the brief-to-lifeboat contract — is unchanged and signal strength lives in Confidence. No new dependency. CHANGELOG.md is untouched: both intents carry impact: additive, so the entry derives from the intent corpus.

Evidence

Probe of a record-less fixture repo (README, NAMING.md, ARCHITECTURE.md, an internal/ tree, work markers, no .abcd/):

constraints/naming      | partial | medium | conventions  → NAMING.md
evidence/open-questions | partial | low    | conventions  → 4 markers across 2 files
    internal/core/convert.go:3 (TODO)   internal/core/convert.go:6 (FIXME)
    internal/store/store.go:3 (XXX)     internal/store/store.go:4 (HACK)
internals               | partial | high   | conventions  → ARCHITECTURE.md,
    cmd/wreck/, internal/core/, internal/store/
glossary                | blank                            → still convGlossarySource's, no duplicate adapter

Every file in that tree hashed identically before and after the probe — disembark is read-only over its source, asserted byte-for-byte rather than by argument.

Review trail

Each intent was built detector-first and reviewed by independent ruthless and security agents before its PR. Both rounds returned FIX-FIRST; the findings that mattered:

• Fabricated evidence — the marker pattern matched the XXX-XXX-XXX redaction shape its own comment claimed it rejected, so a support phone number became a cited "open question". Fixed and pinned by a spelling table.
• Unbounded aggregate read — the file cap and the per-file cap multiply to ~195 GiB with nothing bounding the product. An aggregate read budget now bounds it.
• Denial of service on a hostile tree — the walk's cap counted regular files only, so a tree of directories holding nothing regular never reached it; and os.Root re-resolves each directory one component at a time, making a directory chain quadratic in depth. A depth-1500 chain did not finish in two minutes; it now walks in 0.4s. Directories are counted against the same cap and descent is capped at maxWalkDepth.

Running through all of it: a bound that fires must say so. Every cap is named in the cited evidence, and a blank drawn from a scan that was cut short says the scan was cut short rather than generalising over files it never opened — a blank is a first-class result (adr-35) only while it is trustworthy.

Decisions recorded

.abcd/work/DECISIONS.md gains two entries a future session would otherwise re-litigate: that the mapping table's per-tier columns are a ceiling adapters honour rather than a loose prediction (with the revisit path — amend the row first), and that any whole-tree traversal must state which of {entries, depth, aggregate bytes} bounds it, because a per-item cap and a count cap multiply and their product is not a bound.

Open captures

iss-116 (the walk skip set knows only Node and Go, so a Python .venv is cited as the team's own markers and can consume the walk cap ahead of src/), iss-111 (the bare-word alternative matches prose about markers — 42 such hits on this repository), iss-112 (fs.WalkDir's per-directory ReadDir is unbounded, so the file cap does not bound walk memory as its comment claims), iss-114 (os.Root path re-resolution is the quadratic underneath the depth cap). iss-113 resolved in-branch.