feat(cli): heal pre-date-slug ADR guidance in existing repos; author the minting contract in the managed surface

[4lgn]

Why

adr-date-slug-identifiers (shipped in 1.17.0) moved new ADRs to YYYY-MM-DD-slug names — but only for new repos and the ongoing index. A consuming repo reported the gap: its seeded docs/adr/README.md still said "take the next free number", agents followed it, and 0053 collided across master and two open PRs.

That's not a sync bug — it's by design, and it exposed a root cause:

• The registry is a seeded file, and sync deliberately never rewrites seeded files (the safety rail from ADR-0006/0031). The date-slug ADR even rejected "regenerate from sync" for exactly this reason.
• launchrail adr index only rewrites the table between the markers — never the "Maintaining this registry" prose where the numbering instruction lived.
• doctor is read-only.

So the forward fix had no propagation path into existing repos, and the one instruction that most needs to stay correct — how an agent mints a record — was authored only in project-owned files the toolchain had promised never to touch.

What

The fix leans on the two write surfaces this repo already has — sync (continuous, managed files only) and migrations (one-time, structural, may touch seeded/project-owned with dry-run + checksum awareness + lockfile recording):

1. Managed surface is authoritative. The full ADR-minting contract now lives in the managed .launchrail/CLAUDE.generated.md (which sync keeps current). The seeded registry and 0000-template.md keep a project-owned summary that defers to it, so it can never silently drift again.
2. One-time heal migration 2026-09-heal-adr-minting-guidance: rewrites the pre-date-slug "Maintaining this registry" section and the # ADR-NNNN: template only when the text is byte-for-byte what Launchrail seeded (both were byte-stable from ADR-0031 until the dated scheme). A section a project has edited or ejected is theirs — reported, never overwritten. It surgically replaces only that section, preserving the project's live picture and index table.
3. Sharper doctor: the duplicate-id warning now names the colliding files and prescribes the safe resolution (rename the newer collider to a dated slug — dated ids can't collide). Existing numbered duplicates are never auto-renamed — never-renumber stands; that edit stays a reviewed action in the consuming repo.

New ADR managed-not-seeded-guidance records the decision and amends adr-date-slug-identifiers.

Evidence

• pnpm build clean; pnpm test 256 passing (+11 new: heal helper states, adrDuplicates, migration heal/skip-modified/skip-ejected/idempotency, doctor file-naming).
• End-to-end through the real CLI: init a repo → plant the exact 0031-era stale registry + template → mark the migration pending → run real sync. It heals both files; the file-surface pass still logs keep docs/adr/README.md (exists — seeded files are never overwritten), proving the migration is the only thing that touched the seeded file. Second sync is a no-op (idempotent); adr index then completes the table; doctor reports migrations all applied.
• launchrail adr index regenerated in the same commit; the date-slug ADR's row shows the derived amended by [managed-not-seeded-guidance] backlink (no edit to that record).

Consuming-repo note

This heals the toolchain's side. The reporting repo's existing duplicate 0053 records still need a reviewed rename (give the newer colliders dated YYYY-MM-DD-slug.md names, fix references, run launchrail adr index) — the migration removes the stale instruction so it stops recurring.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DDgcDibdyXw6VhXX4kmP3C

---

Generated by Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}