[specter119]

Summary

Delivery order had become the repository's organizing principle. Tests, fixtures, experiments and documents were split per milestone, and benchmark, profile and acceptance output was committed under docs/milestones/ (about 2.2 MB). Finding what one capability does meant first learning which delivery introduced it.

This PR organizes the repository by capability instead and adds a review stance that guards the value behind it. src/ module layout is untouched.

What changes

New review stance. luwu-coherence-review states the value: a reader must understand a capability from its current form, in one place, without replaying delivery order. It deliberately does not prescribe a layout and does not govern how src/ is divided. luwu-verifiability-review no longer treats milestone records as evidence; the other review skills now cite tests.

Documents.

• docs/milestones/ is removed. What each delivery added is now one small docs/changelog.md with a capability-by-delivery matrix.
• docs/status.md is a current capability matrix with open limits.
• docs/roadmap.md keeps the open exit conditions (M6 user trial, M7 Droid workspace-trust evidence) and the M8/M9 plans.
• Performance budgets, measurement rules and rejected alternatives moved to their owners (maintenance.md, design.md).
• reference.md and design.md use version names instead of M-labels. Error codes and message strings are unchanged.
• The AGENTS.md ownership table is updated.

Tests. 52 milestone-named files are regrouped into tests/<capability>/ (manifest, inputs, formats, drift, planning, apply, filesystem, reverse, records, interruption, providers, cli, scenarios, tooling). The two largest mixed-capability suites (profile engine and profile scenarios, about 4.7k lines) are split by capability. Shared builders live in tests/support/. Fixtures are named by scenario. A README quickstart test is added, because the README claimed an E2E check that did not exist.

Run output. No run results are committed. Benchmarks, profiles and rehearsals write to the ignored /.evidence/. The 15 experiments/ scripts are renamed by capability.

Lockfile. uv.lock now points at public PyPI. scripts/uv_lock_pypi.py refreshes it through whatever index the machine has configured, rewrites every URL to PyPI, and refuses to keep a lock that names another host. The prek uv-lock and ty hooks set UV_DEFAULT_INDEX so the check also passes on machines with a private default index. Hashes are untouched.

Tooling. pre-commit hook revisions for uv, ruff and ty are updated, and Markdown tables are realigned by mdformat.

Recovering removed records

The deleted milestone records are preserved in commit bb80335, for example git show bb80335:docs/milestones/m3.md. The changelog says so.

Verification

• 646 tests passed in checkout mode and from an installed wheel. The new lockfile test file adds 4 more.
• Moved tests: 641 methods are AST-identical to their originals, with a one-to-one id mapping. Each moved module also passes when run alone.
• The 49 profile engine tests were split by capability with AST-identical bodies. The 18 profile scenario tests were renamed during the split and verified by running them.
• All 10 boundary ablations passed after the regroup. Later edits to experiments only touched docstrings and help text.
• ruff check, ruff format --check, compileall and git diff --check pass. Markdown links and anchors resolve.
• prek -a passes except gitleaks, which I could not run in my environment (it downloads Go and the certificate check fails there). It passed earlier with the previous hook revisions.
• Three adversarial review passes (design, durable-content audit, link audit) shaped the final layout.

Known limits

• src/ still has m6_* / m7_* modules and M6* / M7* exception names, and a few user-visible messages mention "M7". This is intentional: layout is a design question, and message strings are public.
• Test classes keep V<n> suffixes. Behavior that differs by manifest version is a real dimension of a capability, and maintenance.md says to keep it visible inside the capability's module.
• After the last lockfile and hook changes, a full-suite run in my session was disrupted by random SIGSEGV crashes (the kernel log shows general protection faults in python3.13, libc and curl). Every failure was a -11, with no assertion failures. The last clean full run is the 646-test result above. Please rely on CI for the final confirmation.