docs: this repo is public, so say what things are, not who decided them

Comments and served API descriptions here had grown references that only make
sense to someone with our internal notes: relative paths that escape this
tree, filenames and titles of documents nobody outside can open, quoted prose
from them, and the name of a component that has no public surface — once in an
OpenAPI description, which is published output rather than source.

None of it was load-bearing. Every case restates as what the code actually
requires, and every rewrite came out shorter: "in the words the host agent
reports" for a component name, "republished as addresses are discovered" for a
quoted phrase, "a size tier sets vCPU, RAM and the output geometry" for a
sentence that had been carrying a path.

Internal reasoning is now cited exactly one way, ref(d-NNNN) in a source
comment, with the rule that the sentence must still stand if the marker is
deleted. CLAUDE.md leads with it, because the previous version of this mistake
was made by people who knew the repo was public and it still took ten
occurrences to notice, so "be careful" is not a mechanism.

Commit messages get the stricter rule and carry no references at all: a
comment can be fixed by the next commit and a published message cannot be
fixed at all. Git hooks now enforce both halves.

The check caught a real one while being written: the CLAUDE.md table spelled
out the paths it was prohibiting, which discloses them to exactly the reader
it protects against.

138 tests, 0 fail.

packages/core/src/machine/index.ts

@@ -133,11 +133,10 @@ export namespace Machine {
 	/**
 	 * Move a host to a different team.
 	 *
-	 * There is no "out of a team" any more: `teamId` is notNull since
-	 * [0048](../../../../.nestri/decisions/0048-email-is-the-root-identity-and-a-box-is-a-row.md),
-	 * so a host always belongs to exactly one, and the single-operator case is a
-	 * team of one rather than a null. What used to be *unscope* is now *move to
-	 * my personal team*, which the caller names explicitly.
+	 * There is no "out of a team" any more: `teamId` is notNull, so a host always
+	 * belongs to exactly one and the single-operator case is a team of one rather
+	 * than a null. What used to be *unscope* is now *move to my personal team*,
+	 * which the caller names explicitly. ref(d-0048)
 	 *
 	 * Scoped to the owner in the query itself, so a machine belonging to
 	 * someone else is a miss rather than a permission check that could be

packages/core/src/machine/machine.sql.ts

@@ -23,8 +23,8 @@ export const MachineTable = pgTable(
 			.references(() => UserTable.id, { onDelete: 'cascade' }),
 		// Every user gets a personal team at signup, so there is always one to
 		// point at and the single-operator case is a team of one rather than a
-		// special case in every query. This was nullable until 0048, which cost
-		// a `teamId ?? ownerUserId` branch at each call site instead.
+		// special case in every query. This was nullable, which cost a
+		// `teamId ?? ownerUserId` branch at each call site instead. ref(d-0048)
 		teamId: ulid('team_id')
 			.notNull()
 			.references(() => TeamTable.id, { onDelete: 'restrict' }),

packages/core/src/machine/machine.test.ts

@@ -62,8 +62,8 @@ describe('Machine registration', () => {
 
 	test('a host always has a team, so registering without one is impossible', async () => {
 		const owner = await newOwner('mch-team');
-		// `teamId` is notNull since 0048 and required by the schema, so this is a
-		// validation failure rather than a row with a null team.
+		// `teamId` is notNull and required by the schema, so this is a validation
+		// failure rather than a row with a null team.
 		//
 		// `toThrow` and not `rejects.toThrow`: `fn()` parses its input
 		// synchronously, before any promise exists, so a bad argument never