refactor(cli): one path-confinement helper and one atomic writer

CHANGELOG.md

@@ -26,13 +26,25 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - Add `rune proof run --check` (transcript, sections, and head ancestry) and `--instruction <key>` (record a model's answer through `rune run`).
 - Feed a step's standard input from `< text` lines in its fence, recorded as command lines, so a scene carries its own script or brief.
 - Mark every scene in `proof.cast` with a rule, a `# Scenario:` title with its index, and an ok or unproven verdict line, so a cast player lists the scenes and an expected refusal reads as one.
-- Add `rune spec glossary`, which prints every ontology term as `- **label**: comment [TAG]` with the `[TAG]: <iri>` definitions a document copies, and `--json`.
-- Add `rune spec glossary --write [PATH]`, which writes the glossary file (header, term list, definitions) from the ontology into `glossary.md` beside the specifications or the given path.
-- Add `rune spec glossary --check [PATH]`, which compares the file with the ontology, names each term whose line is missing, extra, or changed, and exits 1 on drift or a missing file.
-- Read defined terms from `ontology/rune.ttl` (or the `ontology` path in `deck.yaml`) in `rune spec validate` and `rune spec doctor`, falling back to `glossary.md` only when no ontology file exists.
+- Add `rune spec glossary`, which prints every ontology term as `- **label**: comment [TAG]` with a `[TAG]: <page>` definition per term, and `--json`.
+- Add `rune spec glossary --write [PATH]`, which writes one glossary page per term and an `index.md` under `glossary/` beside the specifications, or under the given directory.
+- Give each glossary page `title`, `iri`, `kind`, and `status` front matter, the term's comment, and a generated-from line.
+- Remove, on `--write`, the pages of terms the ontology no longer defines and the single `glossary.md` an older render wrote.
+- Add `rune spec glossary --check [PATH]`: regenerates every page in memory and reports each page whose bytes differ.
+- Read defined terms from `ontology/rune.ttl`, or from the `ontology` path in `deck.yaml`, in `rune spec validate` and `rune spec doctor`. A repository without an ontology has no terms.
+- Accept `rune:status "draft"` on a term.
 - Fail validation on an unreadable ontology, an undeclared prefix, two terms of one kind whose labels match without case, or an ontology with no labeled term.
-- Report `term-reference-missing` when the first italic use of an ontology term carries no `[TAG]`, and `term-reference-unresolved` when the tag is undefined or names another IRI.
-- Apply the term reference rules in `rune validate` to `docs/decisions` and `runes` of a deck, and to the record and rune directories of a module, when the root has an ontology.
+- Mark a term as a link to its glossary page: `*[text][TAG]*` at first use, `[text][TAG]` later, and `[TAG]: <relative page path>` at the end of the file.
+- Resolve a term link through its page's `iri`, or through the tag when the page is absent. Plain italics are emphasis and are not checked.
+- Report `spec-term-undefined` when a link names no term, including a reference tag with no definition in the file, and `spec-term-draft` (warning) when the term is a draft.
+- Report `spec-term-first-use` when the first use of a term in a file is not emphasized, or a later use is.
+- Report `spec-term-legacy` (warning) on the old `*term* [TAG]` form or an IRI definition, naming the new form. A delta gets `delta-` twins of every term code.
+- Apply the term link rules in `rune validate` to `docs/decisions` and `runes` of a deck, and to the record and rune directories of a module, when the root has an ontology.
+- Add `rune spec fix --terms`: adds a draft ontology entry for every term link that names no term and writes its page.
+- Add `rune spec fix --links`: rewrites the legacy italics form to the link form across the repository, idempotently.
+- Run both fixer passes when `rune spec fix` gets no flag. Both are idempotent.
+- Skip, in the fixer's walk, version control, build, dependency, and fixture trees, a deployed tree (a directory with a `.manifest`), the change archive, and the glossary.
+- Refuse `rune spec archive` on a change whose files link to a draft term or to no term, naming each link.
 - Refuse `rune sign queue` on a head that `origin` already holds or sits above, because signing it in place would rewrite a pushed tip.
 - Report jj's immutable-commit refusal in `rune sign next` without a retry, print the pinentry focus hint on every timeout, and print the `jj git push` line after a signed head.
 - Add `rune launch --check` and `rune run --check`, which ask each base URL in the plan for its model list and report every model the plan sends as served or missing, without spawning.
@@ -140,6 +152,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ### Changed
 
+- Share one path-confinement helper and one atomic-replace writer across adopt, deploy, doctor, the review record, and the bench writers.
 - Sort two glossary terms that share a label by kind, the class first, then by name, so `rune spec glossary` keeps one order whatever the order of the ontology file.
 - Run the Vale hook with `--no-global`, so the guarded gate reads the repository's style alone and a rule in the machine's global config cannot fail or mask it.
 - Rename `rune run --clean-harness-state` to `--clean`, and the JSON field to `clean`. The old spelling and the `_scope` field are gone.
@@ -152,7 +165,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - Sync the ceremony files to skeleton `6374d8fc` through `copier update`: seven dcg packs with fixtures, `.dcg.toml`, the lane table, the direct-push signature check, admin-role rulesets.
 - Change the correctness caller to skeleton `5e4657bf`: the controller runs on every same-repository push, draft or ready, so the green draft starts the review round.
 - Change the ceremony files and the embedded skeleton to `60ad8249`: owner-seal messages and nonce, jq guards, versioned display names, `thread-resolver.yaml` retired.
-- Change `rune sign` to read `KEYS` as `signer <fingerprint> <address>...` lines (skeleton `trusted-key-anchor`), with the armored block as a fallback and a malformed line refused.
+- Change `rune sign` to read `KEYS` as `signer <fingerprint> <address>...` lines (skeleton `sign-with-trusted-keys`), with the armored block as a fallback and a malformed line refused.
 - Change `rune sign open` to accept a head the owner signed already, because the open-seal is a new commit above it, and to refuse only a signature from a key outside `KEYS`.
 - Change `rune sign open` to read the body and `schemas/PULL_REQUEST.mdschema` from the bookmark's own tree, so `--repo` may point at a workspace on another branch.
 - Change `rune sign adopt` to judge the outside body against the protected branch's schema, never the outside tree's.

KEYS

@@ -1,4 +1,4 @@
-# Trusted signers for this repository (docs/specs/trusted-key-anchor).
+# Trusted signers for this repository (docs/specs/sign-with-trusted-keys).
 # One line per signer: the pinned fingerprint, then the addresses whose Web
 # Key Directory (or GitHub key list) supplies the bytes, tried in order.
 # scripts/trusted-keys resolves this file; nothing is trusted but the pin.

authors.yaml

@@ -1,6 +1,6 @@
 # Commit attribution policy. Human identities and vendor aliases stay explicit.
 # Model identities use matching IDs and an approved harness domain.
-# See docs/specs/model-commit-attribution/spec.md for the contract.
+# See docs/specs/model-identity-on-commits/spec.md for the contract.
 authors:
     - Martin Zeman <N4M3Z@users.noreply.github.com>
     - Claude (claude) <claude@claude.noreply.nexus.local>

defaults.yaml

@@ -132,3 +132,7 @@ providers:
             strong: [claude-opus-4-6]
             fast: [claude-sonnet-4-6]
             light: [claude-sonnet-4-6]
+
+# A change id or a capability name says what it guarantees, in at least four words.
+spec:
+    min_name_words: 4

docs/README.md

@@ -6,7 +6,7 @@
 - [Crew Parity](Crew%20Parity.md): capability matrix against crew, pinned with non-goals
 - [Exit Codes](Exit%20Codes.md): the exit-code and locking contract for scripts and CI
 - [Command Map](Command%20Map.md): how install/assemble/deploy/copy, the health ladder, and import/adopt relate
-- [Skill authoring](changes/interactive-rune-shell/design.md): the Stable shell heading convention, which checker enforces which part of it, and where the rule lives
+- [Skill authoring](changes/stable-shell-for-skills/design.md): the Stable shell heading convention, which checker enforces which part of it, and where the rule lives
 - [Schemas](Schemas.md): every schema-shaped file, what it constrains, who loads it, and why the skills schema has three copies
 
 ## Walkthroughs

docs/Schemas.md

@@ -89,5 +89,5 @@ otherwise. The two are not equivalent: the built-in checker implements required
 section presence, heading level continuity, and maximum depth, and skips
 optional sections before reading them. Section order, unexpected sections,
 permitted subsection placement, and heading uniqueness exist only in the
-standalone checker. See [Skill authoring](changes/interactive-rune-shell/design.md) for the
+standalone checker. See [Skill authoring](changes/stable-shell-for-skills/design.md) for the
 requirement-by-requirement split.