docs: re-point the source citations the 2026-10-11 changes moved after #555

[bonk-ai]

What and why

#555 (298d986) refreshed the path:line citations in the hand-written reference, behavior, architecture, analysis, diagram and insight pages against its own tree. The commits merged after it on 2026-10-11 that touch source, tasks, tools or verify/ (#556, #557, #574, #575, #576, #578, #579, #580, #581, #582, #583, #584, #585, #586, #587 and the 1.0.0 version commit #588) moved code in the cited files, so many citations still resolve, which is all docs:check tests, while pointing a few lines away from the code they named. This re-points them to HEAD (9a14279, the v1.0.0 tag) and corrects one sentence a source change made incomplete.

How each citation was moved

The baseline for each citation is the commit that last wrote its doc line (git blame): 298d986 (#555) for most lines, a19e0f0 (#556, which reworded prose and kept the numbers) for some, and 5fc581b for a few lines #555 kept unchanged. For the 5fc581b lines, the cited text at 298d986 is the same text at the same line, so #555's tree is their baseline too.

• 348 citations were moved mechanically: the lines a citation covered at its baseline occur byte for byte exactly once at HEAD, and the citation now names that range. A second pass reread every one of them from git and found 0 mismatches.
• 46 more were moved after a read-only audit. Their cited text changed or occurs more than once at HEAD, so an auditor read each doc sentence, the baseline range and HEAD, and chose the range that covers the same construct. Examples: routes.rs:31-56 became 31-57 because platform hooks gained their own routing line, and http.rs:109-128 became 116-136 because send now reads bodies through collect_body. Twelve rows the audit checked were already right and are unchanged.
• docs/reference/public-api.md:5 cited crates/microvms-core/src/lib.rs:98, which was a blank line at 298d986 too. It now cites lib.rs:85-95, the facade's re-export block (microvms_domain at 87, microvms_app at 90, microvms_edges at 91, protocol at 95), which is what the sentence describes.
• docs/behavior/state-machines.md (GuestRead): Bind verified tunnel sessions to their requested destination #585 made caller_vanished leave the guest at Open when the daemon never connected to the guest port (crates/model/src/tunnel.rs:507-516: if !next.daemon.dialed { GuestRead::Open } ...; dialed is documented at tunnel.rs:300-301 as "The daemon connected to the guest port."). The sentence said it always chooses Reset or Eof, so it now names the Open case first. It is also split at its semicolon. That removes one ai-tells.SemicolonUsage warning, and .vale/warnings.json lowers that rule's ceiling from 299 to 298, as CONTRIBUTING's "Prose checks" section asks.

Pages touched: docs/reference/ cli, public-api, rpc-tools; docs/behavior/ processes, state-machines; docs/architecture/ data-flow, module-map, system-overview; docs/analysis/ dead-code, ownership, risk-hotspots; docs/diagrams/ components, sequences, dependency-graph; docs/insights/ business-logic, contract-map, debugging-guide, impact-analysis, tech-debt. No line was added or removed, and no fenced evidence document (PROTOCOL, TRUST, PLATFORM) changed.

Left unchanged on purpose

Eight audited rows describe behavior the code no longer has, so moving their citations would point a false sentence at code that refutes it. They keep their old citations and are listed under Follow-ups. Unverified: 29 citations of Cargo.toml lines that differ from the baseline only in a version string (the 1.0.0 bump) were left in place after a mechanical check, not read one by one.

Evidence

• mise run docs:check on this tree: EXIT=0 in 101 s, vitest Test Files 14 passed (14) and Tests 216 passed (216). It resolves every path:line citation against git and fails on a dead path. main at 9a14279 passed the same task in a fresh worktree (305 s).
• mise run prose:check on this tree: EXIT=0 in 22 s, Prose: 0 errors, 4111 warnings (main at 9a14279: 4112).
• Seeded-fault anchor probe (every transform in verify/guards/faults/*.toml whose file this PR edits): none exist, so no anchor can go stale.
• mise run pr-body:check -- --body <this body>: EXIT=0.
• mise run check was not run: no .py, .toml, .rs, .tf or .yml file, AGENTS.md, CONTRIBUTING.md or the PR template changed.

Guards

None: this adds no guard.

Follow-ups

• docs/insights/tech-debt.md items 5 and 10, and their "Shows up in" bullets (lines 25, 30, 89, 93, 94, 123, 129), describe debt that is fixed: Pin release build tools and validate tag inputs #576 pinned @napi-rs/cli@3.8.2 in .config/mise/tasks/contracts.toml:275 and :305 and in bindings/microvms-js/package.json:53, and docs: align source notes and CLI installation with current APIs #579 rewrote the lifecycle module docs around Sandbox::adopt (crates/microvms-cli/src/commands/lifecycle.rs:6-13).
• docs/insights/debugging-guide.md:97-100 warns about Serve appearing not to implement Future, but Bound daemon hooks, connections, and archive replacement #583 replaced the axum::serve call with its own hyper accept loop (crates/agentd/src/serve.rs:19-71, serve_connection at :52), so the Serve future the entry names no longer exists.
• crates/microvms-cli/src/commands/lifecycle.rs:2009 still mentions "the module docs' assessment of a Sandbox::attach constructor", which those docs no longer contain (source comment, not docs).
• tech-debt.md items 1, 2, 3, 4, 6, 7 and 9 are now tracked as Extend capability parity to options and remaining public types #567, Automate failing-first proofs for shared parity cases #568, Move run ledger and history into the shared client layers #569, Extend default parity across all supported value kinds #570, Resolve formal findings before enabling strict verification #571, Provide a reproducible optional formal verification environment #572 and Centralize the shared default daemon port #573.

Platform claims

• Not applicable: this changes no claim about AWS behavior.

Scope

• This is not an orchestrator or a fork implementation
  (see docs/STRATEGY.md).