Session C2: one home per kind of fact (F-450) and the scope relay (F-452) — plugin 0.41.0

[BradleyDB]

Base branch must be dev, not main. Base is dev.

Regenerated output committed? The five derived generators were run from the
committed catalog; git diff --exit-code over data/, reference/, wiki/ and
plugins/gs-superadmin/reference/ is clean (a full npm run build at the pinned CLI
changed only generatedAt timestamps, reverted).

What

Session C2 of the September rounds: FH-1 (bus F-450, three instances) and RP-4 (F-452).
Plugin 0.41.0.

• Per-CLI facts ship with the plugin — doc-lib CLI_PIN_FACTS, keyed by catalog
  command id, stamped for the pin and self-retiring (applied only while the workspace
  catalog is at that version; check-stale-facts pins the stamp; test/domain-candidates
  holds every id to the bundled catalog and reds a dead entry).
  • domain-candidates.mjs diff: the four re rules sublists the CLI refuses to run
    bare land in a notEnumerableBare bucket with the flag each needs — never undecided,
    never gating; a tenant exclusion/block against one is reported inert (tenantRecord)
    and not counted; pinFacts in the output.
  • manifest.mjs report: domains.<domain>.scope ({ key, path, limit } | null) derived
    from each stamp's recorded listCommand, plus top-level pinFacts — T-2 v4, additive,
    conformance-pinned. Nothing recorded per tenant, no backfill.
  • setup/references/index-scope-notes.md restructured into one ### subsection per
    limited command (headed by the canonical path scope.path names); check-doc-drift
    check 23 holds the table and the subsections to each other both ways (fence-aware,
    reader-gated; rig mutants 23a–g).
• CONVENTIONS.md: workspace-wide by default, per-tenant override (ruled 2026-09-15):
  readAliasConvention reads <slug>/CONVENTIONS.md when it exists (the home whatever it
  says), else the workspace file; every result carries home/path, the deps report
  header and the exact-only caveat name the file read. Precedence tenant file > adopted
  pack > workspace file, stated once in the operating model, followed by the template
  banner and the audit / change-request / deprecate / deps-report / email-report prose.
• A blank date string is not a date (the connectors-chains disagreement's cause):
  one isBlankDate/isDateless predicate for the upsert row loop, newerThan, the
  baseline branch and report; an all-blank full list warns once with the redate remedy
  and names a frozen count; stored blanks are cleared on the next upsert
  (blankDatesCleared).
• RP-4: the setup Phase 4 relay names every scope-limited domain from scope with its
  limit and the fact that the remainder can be added later, before the totals question;
  setup/refresh/upsert-batch stop listing the limited commands from memory.

Bus: F-450 and F-452 FIXED with Fix / Judge lines; the live arms are banked in
dev/VALIDATION.md (no tenant read for the scope arm).

Why

F-450: three facts stored at the scope of whatever observed them — a per-CLI fact per
tenant (both tenants re-derived the identical six exclusions by live-failing each list
three times; connectors-chains recorded a date field on one tenant and none on the
other at the same pin), a per-tenant fact per workspace (a "Tenant-specific" file every
tenant read). F-452: the one question Phase 4 asks the user was unanswerable while a
CLI-reachable subset read as a tenant total. Measured, read-only, over both real
manifests: 4 notEnumerableBare each (all inert), scope on the two journey domains of
each, gate green, both files byte-identical.

Review notes

Start with doc-lib.mjs CLI_PIN_FACTS (the one home), then domain-candidates.mjs's
candidate loop and manifest.mjs's report scope block / upsert blank rule, then
jo-report-deps.mjs readAliasConvention. Review round (medium, 8 finders + 5
file-batched verifiers): 14 candidates verified, 8 confirmed and fixed (all in this PR),
2 refuted. Full battery, npm run typecheck, both claude plugin validate runs, and the
five derived generators are green locally.

• Plugin version bumped in .claude-plugin/plugin.json with a CHANGELOG entry
  (0.41.0).
• Safety boundary: this PR does not touch hooks/gs-admin-guard.mjs or
  ask-rules generation.
• Skill edits: cross-document consistency checked (operating model / template /
  five skills agree on the CONVENTIONS precedence; setup / refresh / notes agree on
  the scope rule) — the changed skills are walked in the tester round.
  Session / verdict: C2-V, per dev/VALIDATION.md § F-450 / F-452.
• No test or dev step touched real gs-admin state (both real manifests read only;
  sha256 identical before and after).
• No tenant/instance/org-specific data in commit messages or this PR body.