v0.1.5: standalone-readability pass — delink --strip provenance mode ([TT-NNNN]), Tier-2 dangling refs neutralized, verify/review-code giant skills split into reference/ on-demand files; guards now runtime-neutral (bun|node)

core/rules/artifact-index-guards.md

@@ -2,7 +2,7 @@
 
 ## Artifact-Index Guards (mandatory)
 
-> Check-mechanized (injection-budget batch-3, [org-internal #3699]): guards
+> Check-mechanized (injection-budget batch-3, [TT-3699]): guards
 > 1-3's checkable invariants run in the repo's artifact-index-check script
 > (`<artifact-index-check-cmd> <ticket>`, see the term mapping; exit 4 =
 > violation, `--json` summary; tolerant of wild archive-marker dialects).
@@ -16,7 +16,7 @@
 Before creating a `## 工件索引` comment, scan the issue's existing comments
 for the legacy prefix `## Pipeline 工件追踪表`. If found, UPGRADE it
 in place (edit, not create) and rename. NEVER create a second index comment
-(DEFECT-1 / [org-internal #1924]). Mechanized: reports the comment_id to edit.
+(DEFECT-1 / [TT-1924]). Mechanized: reports the comment_id to edit.
 
 ### 2. Never-duplicate invariant (single-comment)
 

core/rules/auto-approve.md

@@ -40,9 +40,9 @@ UI's "auto-accept permissions" toggle (browser-local, not the project
 > fix this table. `merge-pr` is excluded from default/preset `stages` arrays
 > (not structurally blocked; explicitly adding it is not recommended).
 > Legacy stage retirement (12 → 5): the phase-3 retirement ruling doc
-> (Tier-2 reference, reachable via the ticket backend).
+> (instance detail (in the consuming instance)).
 
-Config shape: `"auto_approve": { "stages": ["review-code", "verify"], "stageless": false }` — `stages` empty (`[]`) = all manual; `stageless: true` also auto-approves questions called without a stage. Absent block defaults to `{ stages: ["review-code", "verify", "audit-process"], stageless: false }`; the removed `enabled` field migrates on load (mapping: Tier-2 reference page `rules/auto-approve-detail`). Presets (`safe`/`full`/`off`/`show`): same reference page — `full` never includes `merge-pr`.
+Config shape: `"auto_approve": { "stages": ["review-code", "verify"], "stageless": false }` — `stages` empty (`[]`) = all manual; `stageless: true` also auto-approves questions called without a stage. Absent block defaults to `{ stages: ["review-code", "verify", "audit-process"], stageless: false }`; the removed `enabled` field migrates on load (mapping: instance detail page `rules/auto-approve-detail`). Presets (`safe`/`full`/`off`/`show`): same reference page — `full` never includes `merge-pr`.
 
 ### Stage matching behavior
 
@@ -55,7 +55,7 @@ Config shape: `"auto_approve": { "stages": ["review-code", "verify"], "stageless
 Check logic: the harness 内建的问询与自动批准判定模块
 (resolveAutoApproveDecision).
 
-### Live-gate degradation chain ([org-internal #3531])
+### Live-gate degradation chain ([TT-3531])
 
 An auto-approved question is NOT consumed instantly: L1 — a live human
 watching the session (SSE declaration / fresh presence ping) answers within
@@ -73,7 +73,7 @@ before the gate runs (iron law).
 
 ### Mandatory destructive list (业务决策类问询强制清单)
 
-Origin: [org-internal #3223] — a stage whitelist auto-answered two
+Origin: [TT-3223] — a stage whitelist auto-answered two
 irreversible production data changes because nothing marked them
 `destructive`. A stage whitelist grants "execution gates may proceed
 uninterrupted"; it must NEVER grant "business decisions may be
@@ -87,8 +87,7 @@ is never a substitute for human confirmation of these categories.**
 1. **Merge / release landing** — merging a PR to main, cutting a tag or
    release, deploying/promoting to production (server-side auto-merge is a
    human-configured policy robot, never agent self-answer latitude; kill
-   switch: the auto-merge-low-risk runbook, Tier-2 reference via the ticket
-   backend).
+   switch: the auto-merge-low-risk runbook, instance detail (in the consuming instance)).
 2. **Production database writes** — upsert/update/delete against production
    data stores, production data migrations, live-data backfills.
 3. **Billing / plan changes** — plan or tier migration, pricing/concurrency

core/rules/claim-discipline.md

@@ -52,7 +52,7 @@ plausible-looking result to fill the gap.
   contents, API responses, search hits, metrics. If the tool did not return
   it, you do not know it — say so.
 
-Origin: [org-internal #2115] root cause 5 / [org-internal #2118] — deepseek-v4-flash reviewers fabricated
+Origin: [TT-2115] root cause 5 / [TT-2118] — deepseek-v4-flash reviewers fabricated
 full review JSON when the wiki tool surface (MCP tooling at the time, now
 retired) was unavailable to subagents.
 

core/rules/code-graph.md

@@ -30,7 +30,7 @@ NOT grep + read whole files to reconstruct relationships.
 The main checkout's `.codegraph/` indexes ONLY that tree. A git worktree lives
 outside the repo path, so nearest-`.codegraph/` resolution finds nothing under
 it — graph queries in a workflow worktree silently degrade to grep+read
-(the [org-internal #2561] / TD-006 gap).
+(the [TT-2561] / TD-006 gap).
 
 - `script/session-worktree.sh create` and `script/scratch-worktree.sh create`
   build a per-worktree index automatically: `codegraph init -i <path>` runs in

core/rules/compact.md

@@ -6,13 +6,13 @@ Context compaction keeps long pipelines inside the model's context window.
 Two mechanisms exist:
 
 1. **Stage-boundary compaction** (main session / orchestrator) —
-   capacity-driven [org-internal #2601]: compact at a clean stage boundary
+   capacity-driven [TT-2601]: compact at a clean stage boundary
    ONLY when a capacity trigger holds (below), not merely because the
    boundary was reached.
 2. **Round-boundary compaction** (multi-round reviews) — compact at every
    review round ≥ 2, after the round's state is persisted.
 
-### Stage-boundary compaction (capacity-driven, [org-internal #2601])
+### Stage-boundary compaction (capacity-driven, [TT-2601])
 
 The main session orchestrates the whole pipeline while delegating stages to
 subagents, but still accumulates their result summaries, planning reasoning,
@@ -35,16 +35,16 @@ A trigger holding → compact at the NEAREST clean boundary. No trigger → KEEP
 the context: preserved working context is worth more than the tokens it costs.
 
 **Mixed capacity threshold — min(water_level, absolute cap)
-[org-internal #3321] / TD-434]**: the capacity threshold is
+[TT-3321] / TD-434]**: the capacity threshold is
 `min(context × water_level, compaction.max_context_tokens)` — whichever is
 LOWER (`max_context_tokens` default 100_000; `0` restores pure water_level
-semantics [org-internal #3342]). On large windows the 100k cap binds first.
+semantics [TT-3342]). On large windows the 100k cap binds first.
 Measurement basis: the provider's REAL reported usage (input tokens), not
 local estimates; the rendered guidance and the Trigger A/B overflow paths
 resolve the same normalized values (harness 内建的压缩引导模块, see the
 instance term mapping).
 
-**Sub-session posture [org-internal #3321]**: Explorers compact by returning
+**Sub-session posture [TT-3321]**: Explorers compact by returning
 promptly, persisting only what their skill protocol REQUIRES (review findings
 JSON to the run workspace reviews directory). Workers persist outputs to
 Tier 1 BEFORE finishing. The parent context is where the mixed threshold
@@ -52,8 +52,7 @@ applies. Tier 1 boundary: two-tier-artifacts rule.
 
 **Short runs target zero intra-run compaction** — an implement →
 review-code → verify run fits one window; clean boundaries do not compact
-without a trigger. (Rationale + retired legacy stages: Tier-2 reference page
-`rules/compact-detail`, reachable via the ticket backend.)
+without a trigger. (Rationale + retired legacy stages: instance detail page `rules/compact-detail`, reachable via the ticket backend.)
 
 Clean boundaries where triggers are evaluated (live skills):
 
@@ -74,7 +73,7 @@ DAG-routed runs, the latest review pages, or the DoD matrix
 (`{slug}/05-verify-*`) — to recover the current slug, stage, and outstanding
 items. Do not rely on the compacted summary alone.
 
-**Identity verification precedes re-orientation [org-internal #2459].**
+**Identity verification precedes re-orientation [TT-2459].**
 Every compacted summary opens with a harness-injected `### Session Identity`
 card (agent, role/mode/ticket, CORE artifact rows, role re-read set),
 rendered from role-yaml `compact.preserve` lists and issue CORE rows by the
@@ -99,7 +98,7 @@ The `compact` tool rejects calls made too soon after the previous one
 turns); no boundary type is exempt. Beyond `insufficient_turns` the tool has
 more guard outcomes (`min_interval`, `no_model`, `circuit_breaker_open`,
 `disabled` — rejected; `compaction_in_progress`, `deduplicated` — deferred;
-full table: Tier-2 reference page `rules/compact-detail`, reachable via the
+full table: instance detail page `rules/compact-detail`, reachable via the
 ticket backend). All are accept-and-continue: never retry past a guard,
 never work around the dedup/breaker state. A boundary whose compaction was
 rejected or deferred simply keeps its context; the persisted artifacts still

core/rules/issue-checklist-sync.md

@@ -11,16 +11,16 @@ point and see exactly what is done, in progress, and deferred.
 
 | When | Who | What |
 |------|-----|------|
-| After the DAG artifact is frozen (`review-dag` PASS + freeze confirmation per `analyze-dag/SKILL.md` §Output & Lifecycle step 2, [org-internal #3379]) | Aggregator agent | Convert the source Epic's draft acceptance criteria into a formal checklist; annotate requirement-covered items `_(DAG frozen: {epic-slug}/dag v1)_` |
+| After the DAG artifact is frozen (`review-dag` PASS + freeze confirmation per `analyze-dag/SKILL.md` §Output & Lifecycle step 2, [TT-3379]) | Aggregator agent | Convert the source Epic's draft acceptance criteria into a formal checklist; annotate requirement-covered items `_(DAG frozen: {epic-slug}/dag v1)_` |
 | After each iteration commit (`implement` Phase 4.5) | Developer | Check off items delivered by this iteration |
 | After a PR is created | Developer | Append a `## 当前状态` live-status section (or update it) with PR number + mergeable; in an Epic task list, append the PR reference to the corresponding row |
 | After code review converges (`review-code` PASS, Phase E) | Orchestrator | Check off review-related items; annotate `_(reviewed: round N PASS)_`; update the `## 当前状态` review row; label the PR `ready-to-merge` — keep-mergeable automation takes over (hand-written keep-mergeable commits are retired) |
 | On CI key state transitions (first green / failure / cumulative goal reached) | Verifier or Developer | Update the process-type AC (e.g. "N consecutive green runs") progress note in the issue; record the run number |
 | At `verify` Phase 5.6 (final sweep before PASS) / issue close | Closing agent (Verifier on the primary path; otherwise the last role that closes the issue) | Final sweep — every remaining item gets annotated; **archive-at-close**: fold `## 当前状态`, then mark the `## 工件索引` comment archived per the artifact-index-guards rule guard #3 (see「归档动作」below) |
 
-> Historical ([org-internal #3072] phase 3): the requirements/design/plan exit sync points
-> were archived with their skills (detail: Tier-2 reference page
-> `rules/issue-checklist-sync-detail`, reachable via the ticket backend).
+> Historical ([TT-3072] phase 3): the requirements/design/plan exit sync points
+> were archived with their skills (detail: instance detail page
+> `rules/issue-checklist-sync-detail`, in the consuming instance).
 
 Between sync points the checklist stays as-is. **PR / review / CI
 transitions** MUST also be visible via the live status note below — the
@@ -32,12 +32,12 @@ For flows with externally visible transitions between skill exits —
 standalone bugfix, incident response, long-running reviews — maintain a short
 live status table near the top of the issue body, updated in place via the
 ticket-backend issue-update API at the transition moment (closes the
-stale-issue gap [org-internal #1668]/[org-internal #1689]]).
+stale-issue gap [TT-1668]/[TT-1689]]).
 
 All roles use the literal heading `## 当前状态` (no suffix). If an issue carries
-a legacy variant (e.g. `## 当前状态 (live)` from [org-internal #1668]), normalize it to
+a legacy variant (e.g. `## 当前状态 (live)` from [TT-1668]), normalize it to
 `## 当前状态` at the first transition touched. Example table + legacy-variant
-list: Tier-2 reference page `rules/issue-checklist-sync-detail`, reachable
+list: instance detail page `rules/issue-checklist-sync-detail`, reachable
 via the ticket backend.
 
 Rules:
@@ -57,15 +57,15 @@ Rules:
 - At verify PASS / issue close, fold the table's content into checklist
   annotations and remove the section (see the「归档动作」section below).
 
-### Automated sync ([org-internal #1833], timer-polled since [org-internal #2813])
+### Automated sync ([TT-1833], timer-polled since [TT-2813])
 
 PR / review / CI status-row transitions are automated by the `status-sync`
 poller (deployed as a host timer, every 5 min; event sources + latency table
-on the Tier-2 reference page `rules/issue-checklist-sync-detail`, reachable
+on the instance detail page `rules/issue-checklist-sync-detail`, reachable
 via the ticket backend). Roles do NOT hand-write those three row types. A PR
-body may carry several close refs (batch PRs, [org-internal #3731]
+body may carry several close refs (batch PRs, [TT-3731]
 `land-batch`): rows fan out to EVERY referenced issue
-(`parseClosesFixesWide` — [org-internal #3867], merged 2026-08-31) — Chinese 关闭/修复 refs
+(`parseClosesFixesWide` — [TT-3867], merged 2026-08-31) — Chinese 关闭/修复 refs
 drive rows too, even though the ticket backend never auto-closes those
 keywords. The remaining sync points (checklist annotations at skill exits,
 `## 当前状态` creation, deferral/pending marking, section fold-at-close) are
@@ -80,8 +80,7 @@ deduplicated `[status-sync-cron]` issue.
 Pipeline mode has natural sync points at skill exits; standalone bugfix and
 incident flows do NOT — the only boundaries are commit → PR → review → CI →
 merge, and EACH is a sync point with the same annotations as the progressive
-table above (full table: Tier-2 reference page
-`rules/issue-checklist-sync-detail`, reachable via the ticket backend): fix
+table above (full table: instance detail page `rules/issue-checklist-sync-detail`, reachable via the ticket backend): fix
 commit → tick fix-delivered ACs `_(commit {sha}: file)_`; PR → open/update
 `## 当前状态`; review convergence → tick review ACs + review row; CI
 transitions → process-AC progress with run number; verify PASS / close →
@@ -108,7 +107,7 @@ For tickets routed through the DAG pipeline (see workflow-routing rule
   comment (single-comment invariant). The body aggregator table is kept as a
   historical snapshot at close and does NOT carry ARCHIVE.
 
-### Kind/MVP tickets — exemption ([org-internal #3061])
+### Kind/MVP tickets — exemption ([TT-3061])
 
 `Kind/MVP` tickets run the interactive no-pipeline mode: no stage exits →
 **nothing to sync**, no `## 当前状态` section (no PR/review/CI rows until
@@ -137,7 +136,7 @@ non-checklist content. PR / review / CI transitions ALSO go into the
 
 ### 归档动作（issue 关闭 = 归档）
 
-**生命周期 = 工单生命周期**（[org-internal #1929]）：文档生命周期与源 issue 绑定 —— verify PASS → issue 关闭 = 归档。Tier-2 工件库无独立生命周期。
+**生命周期 = 工单生命周期**（[TT-1929]）：文档生命周期与源 issue 绑定 —— verify PASS → issue 关闭 = 归档。Tier-2 工件库无独立生命周期。
 
 归档是 **显式动作**，由关闭 issue 的 agent 执行：主路径为 Verifier 在 `verify` Phase 5.6；路径跳过 verify 时（audit-only、文档类、standalone/bugfix）由关闭 issue 的 role 代为执行。无论哪个 actor，均遵循 artifact-index-guards 规则 guard #3（机制以共享 write-patterns Pattern 10 为准）。动作序列：
 
@@ -146,7 +145,7 @@ non-checklist content. PR / review / CI transitions ALSO go into the
 3. **标记 `## 工件索引` 归档**：按共享 write-patterns Pattern 10 Archive-at-close 原位 edit（机制以 Pattern 10 为准）。横幅日期以实际关闭日为准。
 4. **关闭 issue**：PR body 的 `Closes #N` 在 merge 时自动关闭；无 PR 的流程由 **关闭 issue 的 agent** 执行工单后端的 issue-close API 完成闭环。
 
-约束（[org-internal #1928] 设计约束；机制细节以共享 write-patterns Pattern 10 Archive-at-close 为准，此处不重复）：
+约束（[TT-1928] 设计约束；机制细节以共享 write-patterns Pattern 10 Archive-at-close 为准，此处不重复）：
 
 - **L 级大件（>~300 行）留 Tier-2 工件库不删除** —— 页面与位置列 URL 保持不动（稳定 URL 供历史与共享契约引用）。
 - **索引/状态/归档判定全部收敛到 issue** —— Tier-2 工件库无独立生命周期；归档标记只落在 `## 工件索引` 评论。

core/rules/issue-cross-linking.md

@@ -14,7 +14,7 @@ regression-test follow-up, or any parent/child breakdown — the issues MUST be
 cross-linked:
 
 - **Parent issue**: after creating all children, update the parent body so its
-  task list references each child by `#<number>` (e.g. `- [ ] [org-internal #1556] — [P0] ...`).
+  task list references each child by `#<number>` (e.g. `- [ ] [TT-1556] — [P0] ...`).
   The ticket backend renders these as clickable links and auto-generates a
   back-reference on each child's timeline.
 - **Child issue**: its body MUST contain a `## 父级 / Parent` section referencing
@@ -25,7 +25,7 @@ cross-linked:
 ### Issue ↔ Tier-2 artifact (pipeline traceability)
 
 When a production skill (`analyze-dag`, publishing the `{epic-slug}/dag`
-artifact; historically the pre-[org-internal #3072] producer skills) publishes
+artifact; historically the pre-[TT-3072] producer skills) publishes
 an artifact to the Tier-2 artifact library, the link to the source issue is
 only **half-built** — the library's index page links forward to the issue,
 but the issue has no link back to the library. A stakeholder opening the
@@ -44,7 +44,7 @@ After publishing, the skill MUST complete the reverse link on the source issue:
   reads the 工件索引 comment and fetches every CORE row's 位置 (shared
   read-patterns doc Pattern 6), instead of hard-coded library paths. Skills'
   re-read instructions therefore point at the index.
-- **Archive-at-close（归档动作, [org-internal #1929]/[org-internal #1928]）** — issue 关闭即归档；Tier-2 工件库无独立
+- **Archive-at-close（归档动作, [TT-1929]/[TT-1928]）** — issue 关闭即归档；Tier-2 工件库无独立
   生命周期。`ARCHIVE` is not just a per-row re-read priority: at issue close the
   whole index is marked archived by the closing agent (Verifier at `verify`
   Phase 5.6 on the primary path; otherwise the Orchestrator / last-role that
@@ -56,11 +56,11 @@ After publishing, the skill MUST complete the reverse link on the source issue:
 - **Sync the issue's checklist** per the issue-checklist-sync rule for the
   matching exit point (live: the DAG-freeze sync point after `review-dag`
   PASS; the legacy requirements-exit / design-exit / plan-exit points were
-  retired with their skills, [org-internal #3072] phase 3).
+  retired with their skills, [TT-3072] phase 3).
 - Skip if no source issue exists (no `Closes #N` / `Fixes #N` / roadmap chunk
   mapping ties this slug to an issue).
 
-**Size/S & Size/M exception ([org-internal #1832]) — RETIRED (2026-08-21, [org-internal #3072]
+**Size/S & Size/M exception ([TT-1832]) — RETIRED (2026-08-21, [TT-3072]
 phase 3)**: retired with the legacy producer skills and the `sizing:` block.
 Historical indexes pointing at in-issue artifacts (`位置 = #comment-{id}`)
 remain valid, readable locations; new artifacts publish where their live

core/rules/session-scope-guard.md

@@ -3,7 +3,7 @@
 ## Session Scope Guard (mandatory)
 
 > Enforcement layer: precheck-mechanized (injection-budget batch-2,
-> [org-internal #3667]) — pre-flight sources 1-3 below live in the repo's
+> [TT-3667]) — pre-flight sources 1-3 below live in the repo's
 > session-conflicts script, source 4 in the claim script's compare-and-swap.
 > This file is the normative definition, NOT part of any `agents_md`
 > injection whitelist since 2026-08-29 — do not re-add; the checks run at
@@ -11,8 +11,7 @@
 
 Standalone and ticket-seeded sessions run without a pipeline around them —
 no plan, no reviewer keeping them inside their work item. When such a
-session hits a test failure NOT caused by its own change ([org-internal
-[org-internal #1803]], via [org-internal #1753]/[[org-internal #1744]]), it tends to fix the foreign
+session hits a test failure NOT caused by its own change ([TT-1803], via [TT-1753]/[TT-1744]), it tends to fix the foreign
 failure in place (drifting off-task), and sessions seeded for the same issue
 collide on the same shared flaky test.
 
@@ -48,17 +47,17 @@ on ANY source → the ticket is already owned: ABORT (or, for a DEAD claim,
 take over via the mechanized channel below; otherwise coordinate on the
 issue), never silently start a second owner.
 
-**Mechanized ([org-internal #3667])**: the repo's session-conflicts script
+**Mechanized ([TT-3667])**: the repo's session-conflicts script
 (`<session-conflicts-cmd> <ticket>`) scans sources 1-3 in one read-only pass
 (exit 4 = conflict, matching the claim script; source 1 fail-opens visibly
-when the app API is down — the backend hard guard [org-internal #1989]
+when the app API is down — the backend hard guard [TT-1989]
 backstops); source 4 IS the claim script's compare-and-swap. Dead-claim
 takeover is mechanized in the claim script (see below); manual recipes:
 the headless-session-ops skill's ticket-recipe reference §0.
 
-**Dead-claim takeover ([org-internal #3668]).** A claim whose session is
+**Dead-claim takeover ([TT-3668]).** A claim whose session is
 gone (404 on the app API) and whose branch was never pushed is a DEAD claim
-— the [org-internal #3419] shape. Do NOT hand-edit the dead claim comment
+— the [TT-3419] shape. Do NOT hand-edit the dead claim comment
 (the retired admin workaround — unauditable); run the claim script's
 takeover subcommand (`<claim-takeover-cmd> <ticket> <branch> --session-id
 <id>`) instead. Evidence rule (the claim script's header is normative): a
@@ -77,8 +76,7 @@ ticket-driven work is to claim the ticket — one atomic action of THREE
 steps, valid ONLY when all complete: (1) set the issue assignee to the
 working account, (2) post a claim comment naming the workflow branch and
 session id, (3) push the workflow branch to remote (even an empty commit —
-a purely local branch is invisible to other sessions, [org-internal
-[org-internal #2280]/[org-internal #2282]]). Use the repo's claim wrappers (staged-transaction claim
+a purely local branch is invisible to other sessions, [TT-2280]/[TT-2282]). Use the repo's claim wrappers (staged-transaction claim
 script; exit codes and CAS semantics in its header; non-zero = NOT claimed)
 and the provision wrapper (adds the worktree + Tier-1 runs scaffold). The
 manual 3-step is the fallback where the scripts are unavailable, same
@@ -88,7 +86,7 @@ re-verification.
 branch's recent commits for `#<ticket>` — surfacing an equivalent
 implementation already on main *before* the merge rejection.
 
-**Merge-time review gate ([org-internal #2345]).** `pipeline/review-code` is
+**Merge-time review gate ([TT-2345]).** `pipeline/review-code` is
 a required status: merge needs it green OR the route-based exemption
 (Kind/* close routes skip review-code — posted by the repo's
 review-gate-exemption script). Read the commit-status endpoint for the PR
@@ -102,7 +100,7 @@ your chunk before starting.
 
 Two sessions owning the same issue or code area is never faster — it is the
 exact collision this rule prevents. If a collision HAS happened, follow the
-failure-path playbook at the ownership-collision runbook (Tier-2 reference
+failure-path playbook at the ownership-collision runbook (instance detail page
 page, reachable via the ticket backend).
 
 ### Scope

core/rules/stash-discipline.md

@@ -13,8 +13,8 @@ each other's entries and one session's `pop` returns the other session's
 content — or `drop`/`clear` wipes uncommitted work belonging to a session in
 a different worktree.
 
-This failure mode has already destroyed completed work in production ([org-internal #1655] /
-[org-internal #1629] — a finished 25-test implementation overwritten on the shared stack).
+This failure mode has already destroyed completed work in production ([TT-1655] /
+[TT-1629] — a finished 25-test implementation overwritten on the shared stack).
 
 **Iron Law: NEVER use `git stash` (or `git stash pop` / `push` / `drop` /
 `clear` / `apply`) inside an octopus worktree.**
@@ -70,7 +70,7 @@ If you must `git checkout <base>` to reproduce a failure but the worktree is
 dirty, do **not** reach for stash. Instead:
 
 - WIP-commit first (option 1), or
-- Use the lifecycle-managed scratch-worktree script ([org-internal #2790]) to materialise
+- Use the lifecycle-managed scratch-worktree script ([TT-2790]) to materialise
   the base commit in a *separate* worktree and run the failing test there:
 
   ```bash
@@ -82,7 +82,7 @@ dirty, do **not** reach for stash. Instead:
   classification check. The script registers the worktree, symlinks
   `node_modules` from the source checkout when `bun.lock` matches, and the
   `sweep` backstop reclaims worktrees abandoned by dying sessions — bare
-  `git worktree add /tmp/octopus/...` has no such recovery ([org-internal #2790]).
+  `git worktree add /tmp/octopus/...` has no such recovery ([TT-2790]).
 
 ### Exceptions
 
@@ -110,4 +110,4 @@ dirty, do **not** reach for stash. Instead:
 If a parallel-session stash collision happens again despite this rule, treat
 it as a Sev-2 process incident: stop work, recover via
 `git fsck --unreachable` / `git log -g --walk-reflogs stash`, open a follow-up
-referencing [org-internal #1655].
+referencing [TT-1655].

core/rules/testing.md

@@ -6,7 +6,7 @@
 - Test actual implementation, do not duplicate logic into tests
 - Tests cannot run from repo root (guard: `do-not-run-tests-from-root`); run from package dirs.
 - **Local pre-check: run `<test-cmd:changed>`** from the owning package after editing source. It selects only tests affected by your uncommitted + branch changes (path-mapping ∪ CodeGraph direct dependents) and runs them in a single process — seconds, machine stays responsive. Use `--print` to see the selection without running, `--all` to scan beyond the home package.
-- **Before a delivery push: `<test-cmd:changed>` green + `<typecheck-cmd>` clean** — same selector as CI's PR side (local parity, [org-internal #4425]). The full suite (`<test-cmd:parallel>`) stays with nightly / `run-full-tests` / manual pre-merge runs. 实例命令绑定见 core/adapters/TERMINOLOGY.md。
+- **Before a delivery push: `<test-cmd:changed>` green + `<typecheck-cmd>` clean** — same selector as CI's PR side (local parity, [TT-4425]). The full suite (`<test-cmd:parallel>`) stays with nightly / `run-full-tests` / manual pre-merge runs. 实例命令绑定见 core/adapters/TERMINOLOGY.md。
 - Never use the bare single-process test runner for the full suite; `<test-cmd:parallel>` shards it and process-isolates known-corrupting files. Parallelism is controlled by `TEST_SHARDS` (default 3; raise it on beefy CI runners, e.g. `TEST_SHARDS=7`).
 
 ### Pre-existing test failures must be filed, not silently logged
@@ -18,7 +18,7 @@ problem" and do NOT bury it in a report body.
 
 - Classify it: run the failing test on the base commit (see `verify` Phase 2.6).
   Fails there too → pre-existing (BF); passes there → regression you must fix.
-- De-duplicate BEFORE filing (retro [org-internal #2696]): search existing
+- De-duplicate BEFORE filing (retro [TT-2696]): search existing
   `baseline-failure` tickets — open AND closed — by test/file name to surface
   candidates, then match by **failure signature** (error signature + affected
   surface — one root-cause family may span several tests; see the
@@ -40,7 +40,7 @@ it is a **flaky test**. Do NOT silently re-run until it passes and move on.
 
 - Detect: re-run the suite (or use the project's flaky detector). Record every
   test that shows intermittent behavior — name, failure rate, and run count.
-- De-duplicate BEFORE filing (retro [org-internal #2696]): same
+- De-duplicate BEFORE filing (retro [TT-2696]): same
   signature-based procedure as baseline failures above, against existing
   `flaky-test` tickets.
 - File it: the Verifier registers every un-tracked flaky test as a
@@ -55,7 +55,7 @@ it is a **flaky test**. Do NOT silently re-run until it passes and move on.
 NOT fix it in place — classify, file, and return to your task per the
 session-scope-guard rule. A repository-wide flaky test is a shared magnet —
 fixing it in place drifts off-task and collides with its owner
-([org-internal #1803]).
+([TT-1803]).
 
 ### Testing Kobalte components with happydom
 
@@ -74,7 +74,7 @@ render reliably.
 
 A single component MUST NOT carry both a `.test.ts` and a `.test.tsx` test
 file — the two-file split duplicated ~3300 lines of overlapping assertions
-across one UI package [org-internal #1712]. Use exactly one file per
+across one UI package [TT-1712]. Use exactly one file per
 component, chosen by test style:
 
 | Test style                       | Extension      | When to use                                                    |
@@ -129,17 +129,17 @@ expect(source).not.toContain(`@${NAMESPACE}`)
 Each package MUST have exactly ONE test root — no parallel tracks
 (`src/**/__tests__/`, a `tests/` dir alongside colocated `src/`, or a `test/`
 alongside `tests/`); a second root drifts and breaks test discovery
-([org-internal #1711], extended to all packages by [org-internal #1821]).
+([TT-1711], extended to all packages by [TT-1821]).
 
 Rules:
 
 - New tests: create them at the package's single root from the start.
 - Do NOT create `src/**/__tests__/` directories in any package — parallel
-  tracks drift (residuals eliminated by [org-internal #1821]).
+  tracks drift (residuals eliminated by [TT-1821]).
 - For `test/`-root packages: mirror the `src/` path (`test/<src-relative>.test.ts`);
   type-level tests live alongside the behavioral suites in the config area.
 - For colocated-root packages: keep tests next to the source file; one test
-  file per component [org-internal #1712].
+  file per component [TT-1712].
 
 Per-package root tables live in the instance layer (they name concrete
 package paths); the invariant itself — ONE root per package — is universal.

core/rules/ticket-lifecycle.md

@@ -1,6 +1,6 @@
 > Core 中立版（Increment 2 改写）。术语对照见 core/adapters/TERMINOLOGY.md；本组织实例表述见 dogfood 对应文件。
 
-## Ticket Lifecycle — registry-first filing, claim-to-promote ([org-internal #3002] G1)
+## Ticket Lifecycle — registry-first filing, claim-to-promote ([TT-3002] G1)
 
 Bugs worth fixing start life as a **registry row**, not an independent ticket.
 This extends the two-tier-artifacts philosophy to the ticket queue: a
@@ -25,20 +25,20 @@ is how the 2026-08 backlog formed.)
   ```
 
 - **TD-NNN** is allocated at REGISTRATION via the ledger mutex
-  [org-internal #3322]: the 配额账本脚本 (`td-alloc` 形态, `bash <alloc-script>
+  [TT-3322]: the 配额账本脚本 (`td-alloc` 形态, `bash <alloc-script>
   <count> <source-slug> [--ticket N]`) takes a contiguous range from the TD
   allocation ledger (a standing tracker issue) — append-only `**td-alloc**`
   comments, earliest-comment-id wins on collision. **ANY allocation — manual
   included — must land a td-alloc comment on the ledger BEFORE the registry
   row is written** (script, tool API, or web UI). Hand-computed `max + 1`
   without a ledger comment is FORBIDDEN (parallel-session races,
-  [org-internal #3322]). The id is **reserved for life**: promotion reuses
+  [TT-3322]). The id is **reserved for life**: promotion reuses
   it, never renumbers. Run the alloc script's `--check` (reconciliation)
   when the last check predates this batch, and in retrospectives.
 - **De-duplication** queries the TD index (same-source rows) plus open
   promoted issues (cross-source); index matching replaces title-keyword
   matching (keyword dedup once produced 18 fragments from one source).
-- **Query-failure ruling ([org-internal #3383]: fail-open, visible)**: if the
+- **Query-failure ruling ([TT-3383]: fail-open, visible)**: if the
   dedup query itself errors (backend API failure — NOT "queried and found no
   match"), retry once; on second failure file anyway, marking the comment
   `dedup-unverified` for retro/reconciliation sweep. Fail-closed rejected:
@@ -63,7 +63,7 @@ source.
 ### PR 准入（pr-admission，TD-678）
 
 会话交付物 = 分支 + 报告；开 PR 属编排职权，按容量串行一次一张、双绿并入
-再开下一张（[org-internal #3864] 管合并出口、本节管 PR 入口）。交付推送前置
+再开下一张（[TT-3864] 管合并出口、本节管 PR 入口）。交付推送前置
 本地验证（`<test-cmd:changed>` + `<typecheck-cmd>` 绿；实例命令绑定见
 core/adapters/TERMINOLOGY.md）。编排不可达可自开，PR 正文标
 `uncoordinated`。细则与门控项：pipeline-gate 清单 PR 准入节。
@@ -75,7 +75,7 @@ occurrence: evidence (run, commit, failing output, failure rate) attaches as
 comments on the family's **umbrella ticket** (ticket-backend issue), keyed by
 failure signature (error signature + affected surface, not just
 `file::test-name` — one root-cause family may span several tests; precedents
-[org-internal #2585], [org-internal #2925]). Filing a new ticket when the
+[TT-2585], [TT-2925]). Filing a new ticket when the
 signature already matches an existing family (open or closed) is forbidden —
 attach evidence instead. A family umbrella is closed when its signature no
 longer reproduces.

core/rules/two-tier-artifacts.md

@@ -53,8 +53,7 @@ Tier 1 is an optimization an artifact opts INTO, not out of.
 ### Common classifications
 
 Per-artifact table (review findings, prompt files, working drafts, draft/frozen
-contracts, issue checklist, 工件索引, `index.json` …): Tier-2 reference page
-`rules/two-tier-artifacts-detail` (reachable via the ticket backend); the
+contracts, issue checklist, 工件索引, `index.json` …): instance detail page `rules/two-tier-artifacts-detail` (reachable via the ticket backend); the
 decision rule above classifies anything unlisted.
 
 ### Two indexes, parallel not replacement
@@ -74,14 +73,13 @@ Closed by the **Verifier** at verify PASS (or the Orchestrator when no
 verify). The archive step is the ONLY point active-run Tier 1 content enters
 git history:
 
-1. Generate the bundle [org-internal #3604]:
+1. Generate the bundle [TT-3604]:
    the run-bundle generator script with `--slug {slug} [--ticket N] [--pr N]`
    — flips meta to "archived", hashes the workspace into the `sha256_16`
    manifest, writes `archive/{ticket}-{slug}.json`, validates.
 2. Commit the bundle on the workflow branch (rides into main via `--no-ff`).
-   Direct pushes to main stay blocked by branch protection [org-internal
-   [org-internal #3604]]; do not bypass.
-3. **归档前置校验** [org-internal #2727]: the generator validates by default
+   Direct pushes to main stay blocked by branch protection [TT-3604]; do not bypass.
+3. **归档前置校验** [TT-2727]: the generator validates by default
    (`--no-validate` must not reach a merge); red exit = fix before close.
    The L0 merge gate rejects non-compliant bundles at merge anyway.
 
@@ -109,7 +107,7 @@ reproducibility trace — enough to reconstruct what a run produced.
 the designated re-read entry — after `compact`, read `runs/{slug}/index.json`,
 not conversation memory.
 
-### Gate furlough（[org-internal #3607]）
+### Gate furlough（[TT-3607]）
 
 强制门的唯一退出通道是 gate 台账（furlough ledger）的 furlough 条目
 （测量证据 + reopen 条件）；无台账条目的减门/跳过改动一律拒绝，台账

core/rules/workflow-routing.md

@@ -24,7 +24,7 @@ On every substantive request that is tied to a ticket, run Step 0:
    `Kind/*` label when known; omit `kind` when not yet read (the tool returns
    the default route plus a read-ticket-then-re-invoke instruction). Agents
    with the route-gate option enabled enforce this mechanically
-   [org-internal #3328]: other tool calls are dispatch-rejected until the
+   [TT-3328]: other tool calls are dispatch-rejected until the
    路由解析工具 runs. Do not hand-read the routing table when the tool is
    available.
 3. **Read the ticket's `Kind/*` label** from the issue body or via the issue
@@ -38,7 +38,7 @@ On every substantive request that is tied to a ticket, run Step 0:
      `skip` / `keep_gates` downstream. Never drop a gate the route lists in
      `keep_gates`; never add back a stage the route lists in `skip`.
 
-### Degradation — label missing, unknown, or wrong ([org-internal #1828] AC)
+### Degradation — label missing, unknown, or wrong ([TT-1828] AC)
 
 - **No ticket / no `Kind/*` label / label not in the table** → `default`
   route (natural-language matching). State this in one line ("no Kind/\*
@@ -64,15 +64,14 @@ On every substantive request that is tied to a ticket, run Step 0:
 
 ### Runtime growth signals (post-sizing)
 
-Two live growth mechanisms (narrative: Tier-2 reference page
-`rules/workflow-routing-detail`, reachable via the ticket backend; retired
+Two live growth mechanisms (narrative: instance detail page `rules/workflow-routing-detail`, reachable via the ticket backend; retired
 Size/* history: the instance rules-history archive). Canonical key:
 `dag.size_derivation.oversize_signals` (TD/DUP-F009).
 
 - **DAG-routed tickets** (DAG Epic, DAG-routed `Kind/Feature`, their
   `Kind/Task` children — no `Size/*` tier): runtime growth fires the
   oversize signals → response is **re-derivation + review-dag re-run**.
-- **Bug tickets (big-bug relabel rule, [org-internal #3061])**: a `Kind/Bug`
+- **Bug tickets (big-bug relabel rule, [TT-3061])**: a `Kind/Bug`
   hitting a design-level trigger (design-decision root cause, shared-contract /
   public-API change, data migration) has outgrown the bug type — mandatory
   action is **relabel `Kind/Feature`** (Step 0 reroutes into the DAG
@@ -87,10 +86,10 @@ never quietly override.
 
 The DAG ticket pipeline (`analyze-dag` → task DAG → single gate `review-dag`)
 is the **default** route for `Kind/Epic` and `Kind/Feature`
-([org-internal #3061] Phase 2 / TD-388). Both resolve via the routes table
+([TT-3061] Phase 2 / TD-388). Both resolve via the routes table
 directly — **no trigger/marker check** (route rollback = revert PR).
 Authoritative definition: the `dag:` block in the workflow-routing table;
-narrative + history: Tier-2 reference page `rules/workflow-routing-detail`.
+narrative + history: instance detail page `rules/workflow-routing-detail`.
 
 1. **`Kind/Epic` or `Kind/Feature` → `dag.route`**: entry `analyze-dag`,
    single gate `review-dag` (replaces review-design-space +
@@ -126,12 +125,12 @@ rules archive; rulings in the phase-3 retirement ruling doc (Tier-2
 reference, reachable via the ticket backend). Nothing trims gates —
 `never_trim` is structural.
 
-### 立案降档 — filing/sprint-mode（[org-internal #3002] G5 / [org-internal #3007]）
+### 立案降档 — filing/sprint-mode（[TT-3002] G5 / [TT-3007]）
 
 Sprint 期间债务侧显式降档，不靠纪律。开关：routing table `filing.sprint-mode`
 （默认 `false`）。`true`（冲刺期）时 verify Phase 5.5 registry-only 不分严重度
 （登记行照写、零丢失；独立工单创建冻结至开关回 `false`，已登记行按
 ticket-lifecycle 规则正常认领升票；期间 HIGH/MEDIUM 行不被 reaper 触碰，
-[org-internal #3004]）。BF/FT（5.55/5.56）不受影响。谁翻转：冲刺负责人（人），
+[TT-3004]）。BF/FT（5.55/5.56）不受影响。谁翻转：冲刺负责人（人），
 在冲刺跟踪单记一行；开关值即 routing table 当前值，verify 每次运行时读取。
-动机与细节：Tier-2 参考页（经 ticket backend）`rules/workflow-routing-detail`。
+动机与细节：instance detail page `rules/workflow-routing-detail`。