docs(builder): phase 8 — modules, architecture and reference

Twenty pages completing the tree section 10 planned: Modules (8), Architecture
(5) and Reference (7). Four decisions, D38-D41, recorded in PLAN.md section 10.

D39 is the one that shaped the phase. Section 1 forbids re-specifying a
contract, and a Reference section is exactly where that rule is most tempting to
break, so the line is drawn at names: every environment variable, config key,
installer command, visibility rung and canonical document is listed with one
terse line saying what it is FOR, while shapes, semantics and every "why" stay
in the canonical document.

That is only safe because the names are checked. checkReference.mjs compares six
enumerations against the repositories that own them, over the Gitea API, as set
comparisons in BOTH directions -- and the second direction is the one that earns
its keep, because a reference page does not usually rot by describing something
that vanished, it rots by quietly not mentioning what was added since.

The check went green on its first run, which is the least trustworthy possible
outcome, so it was verified by breaking it: seven mutations, all caught. The one
worth keeping is the visibility ladder REORDERED with its membership unchanged
-- it is a security boundary, and a set comparison alone would have passed it.

D41 turns plannedSidebar from a checklist into a checked invariant, and finding
out why was the phase's first defect: it had already drifted, because phase 7
added the Content page under D37 and never updated the list. Nothing failed,
because nothing read it. checkSidebar.mjs now asserts the two trees agree on
groups, labels and order -- order because the order of Getting started IS the
installation path.

Two more things the writing found. PLAN.md's page count was wrong and had been
since section 10 was written ("roughly 38, 37 planned" for a tree of forty).
And module.json's `mounts` and the SPA's paths are different mechanisms that no
single document stated plainly -- module-uo declares admin: ["/shard",
"/uo-link"] while its screen lives at /admin/uo/link, because API routes are
deliberately NOT namespaced while SPA routes are. That is precisely the
distinction the installer got wrong in v0.1.0, and it now has a named home.

D40: the docs link to /architecture/'s drawn diagrams rather than importing
them. Those components carry marketing chrome and depend on diagram.css, which
Starlight does not load; the docs use text diagrams, which paste into an issue.

npm run verify green: 40 pages across 5 groups agree with plannedSidebar, 2390
internal links resolve, 123 repository links point at a branch, 19 facts, 59
quickstart checks, 22 reference enumerations, astro check 0 errors, 36 tests.

Co-Authored-By: Claude <noreply@anthropic.com>

.gitea/workflows/pr-checks.yml

@@ -65,6 +65,19 @@ jobs:
         # the shorter form would pass locally and break only here.
         run: npm test
 
+      - name: Sidebar
+        # PLAN.md §12, phase 8. src/config/sidebar.mjs holds two trees — the one Starlight
+        # renders and the one §10 planned — and they must agree on groups, labels and
+        # ORDER. Order because the order of "Getting started" IS the installation path.
+        #
+        # While pages were being written the planned tree was a checklist; now that every
+        # page exists it is a hand-maintained second copy, and it had already drifted
+        # unnoticed (phase 7 added Content under D37 and never updated it). Nothing caught
+        # that because nothing read it.
+        #
+        # No token, no network, no build — so it runs early and fails fast.
+        run: npm run check:sidebar
+
       - name: Production build
         run: npm run build
 
@@ -115,3 +128,22 @@ jobs:
         env:
           GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: npm run check:quickstart
+
+      - name: Reference enumerations against their sources
+        # PLAN.md §12, phase 8. The Reference section names things — every environment
+        # variable, config key, installer command, visibility rung and canonical document.
+        # §1 forbids re-specifying a contract, and this is what makes writing the NAMES
+        # down safe anyway: each list is a SET comparison against the repository that owns
+        # it, in both directions.
+        #
+        # The second direction is the one that earns its keep. A reference page does not
+        # usually rot by describing something that vanished — it rots by quietly not
+        # mentioning the three things added since it was written.
+        #
+        # Descriptions are deliberately NOT checked; nothing here can know whether a
+        # one-line summary is still true, so it does not pretend to.
+        #
+        # Same token, and for the same reason: it reads five other repositories in the org.
+        env:
+          GITEA_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: npm run check:reference