docs: cite MESHBAY_DESIGN.md and a section instead of the merged notes

The per-feature design notes were merged into docs/MESHBAY_DESIGN.md and
deleted from the tree on 2026-09-11, but ~230 comments across the three
packages still named them — usually written `docs/musicbay.md §3.2`, as
though the file were still in docs/. A reader had to know §16 existed to
resolve any of them. They now name the section directly.

Every mapping comes from §16, the concordance, which already records where
each old section landed: musicbay -> §9.8, mediacenter -> §9.7 for the
Videos app and §6.5 where the subject is derived data, photos -> §9.9,
auth-confirm -> §3.6, refactoring-search -> §9.11, invite-pairing-v1 ->
§3.4, per-node-identity-v1 -> §3.2, captcha -> §7.7, chat-sender-keys ->
§4.5, apps/refactor-groups -> §9.1–§9.4, desktop-client-v1 per section.
Bare citations of the same documents (`draft-v6 §2.11`, `§4.8`, `§3.4`)
are retargeted too: those collide with real section numbers in the design
document, so leaving them would have been worse than the named form.

Four cases the concordance does not cover, each decided rather than guessed:

  Sub-item references into documents that no longer exist — mediacenter's
  `§3.3 row 4`, `§3.4b/c`, `apps.md §3b` — name rows and sub-items §9.7 and
  §9.2 do not reproduce. The module-level citation stays; the sub-item
  pointer is dropped.

  The V-findings keep their labels but lose the dead `§10.1/` prefix.
  §13.8 lists V1–V13 as per-application open items, which is not what the
  labels mean in these comments, so pointing them at §13.8 would have been
  a false citation.

  `apps.md §5`'s virtualization requirement has no counterpart anywhere in
  the design document. The requirement is stated in the comment itself, so
  the citation is dropped rather than aimed at a section that does not say
  it.

  Comments that attributed a *sentence* to an old note — musicbay's "several
  thousand files" example, its "what got measured" note, its measured
  ~11%/~26% cover-art figures, the "original no root, whole shared tree"
  call — state the fact without attribution now. §9.8 does not contain those
  sentences and citing it for them would have been wrong.

CLAUDE.md's "a reference to a document that no longer exists" row now says
the concordance is for git history and out-of-tree material; the code cites
sections directly.

Verified: 2851 passed, 4 skipped. The 12 errors in the run are the Firefox
leg of test_sticky_header.py's browser harness, which is broken at the
browser level on this machine — headless Firefox (snap) dies with
`[GFX1-]: RenderCompositorSWGL failed mapping default framebuffer`, renders
nothing, and the probe exits `{"error": "no measurement"}` after its full
90s wait. Chrome runs the same 12 assertions in 3.2s and passes. Nothing
here can affect it: every changed line in style.css is inside a comment.
Also checked: ast.parse on every changed .py, `node --check` on every
changed .js, the /* */ balance in style.css, and that no changed line
exceeds the width its file already used.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 13 insertions, 12 deletions

diff --git a/packages/meshbay-common/src/meshbay_common/__init__.py b/packages/meshbay-common/src/meshbay_common/__init__.py
index c5b0279..1d857fd 100644
--- a/packages/meshbay-common/src/meshbay_common/__init__.py
+++ b/packages/meshbay-common/src/meshbay_common/__init__.py
@@ -26,7 +26,8 @@ __version__ = "0.14.0"
 # older client simply never sends/handles the new pair.
 # 0.8: added `artist`/`album`/`track_no` to `IndexEntry`, and
 # `musicbrainz_config`/`_ack`, `musicbrainz_enabled`/`_ack`,
-# `music_meta_req`/`_resp`, for the Music group app (docs/musicbay.md).
+# `music_meta_req`/`_resp`, for the Music group app
+# (docs/MESHBAY_DESIGN.md §9.8).
 # Same shape as 0.5-0.7's Videos additions, and reuses `duration`/
 # `thumb_hash`/`display_title` rather than declaring new ones. Additive:
 # an older client simply doesn't render the new fields or send the new
@@ -38,29 +39,29 @@ __version__ = "0.14.0"
 # client never sends the request, and simply can't play those two formats,
 # same as before this existed.
 # 0.10: added `audio_root`/`_ack` — the Music app's own entry point, same
-# shape as `video_root`/`_ack`. Reverses musicbay.md's original "no root,
-# whole shared tree" call: a real messy library showed that call was
-# wrong, and Music now requires one before showing/enriching anything,
-# exactly like Videos. Additive at the protocol level: an older client
-# never sends the op and never expects the field.
+# shape as `video_root`/`_ack`. Reverses the original "no root, whole
+# shared tree" call: a real messy library showed that call was wrong, and
+# Music now requires one before showing/enriching anything, exactly like
+# Videos (docs/MESHBAY_DESIGN.md §9.8). Additive at the protocol level: an
+# older client never sends the op and never expects the field.
 # 0.11: added `taken_at`/`camera` to `IndexEntry` (best-effort, from a photo's
 # own EXIF block) and `photo_roots`/`photo_roots_ack`, for the Photos group
-# app (docs/photos.md). Unlike `video_root`/`audio_root`, `photo_roots` is a
-# *set*, replaced whole in one signed op — a photo library is routinely
-# scattered across several folders, not one. Additive: an older client
+# app (docs/MESHBAY_DESIGN.md §9.9). Unlike `video_root`/`audio_root`,
+# `photo_roots` is a *set*, replaced whole in one signed op — a photo library
+# is routinely scattered across several folders, not one. Additive: an older client
 # never sends the op and never expects either field.
 # 0.12: added `link_preview_req`/`link_preview_resp` — the node unfurls a URL
 # pasted in chat into an OpenGraph card. Additive: an older node logs "unknown
 # type" and the client just shows the bare link, as it always did.
 # 0.13: added `tmdb_rematch`/`tmdb_rematch_ack` — an operator dropping one
 # file's cached TMDB match so it re-resolves with the current matcher
-# (§10.1/V13). Additive: an older node logs "unknown type", the client's
+# (V13). Additive: an older node logs "unknown type", the client's
 # button just does nothing.
 # 0.14: added an optional `bundle_enc_recovery` field on `keypair_bundle_store`
 # and `keypair_bundle_resp` — a second copy of the identity bundle wrapped
 # under the account's recovery key, so a forgotten passphrase does not strand
-# the identity (docs/auth-confirm.md §4.3). Additive: an older node ignores the
-# field on store and never returns one; an older client never sends it.
+# the identity (docs/MESHBAY_DESIGN.md §3.6). Additive: an older node ignores
+# the field on store and never returns one; an older client never sends it.
 # 0.15: `file_chunk` and `index_sync` had forked between the transports — WebRTC
 # sent binary, unsigned chunks and plain index entries, QUIC sent base64 chunks
 # with a per-chunk Ed25519 signature and a `GroupIndex.serialize()` envelope. One