docs(6209): forge, dedup, tuning, registry, reply shapes and discipline, checkpoint, lesson kind tests

Eight more test files state their properties without issue, milestone,
rule and decision numbers. The tuning and suspension notes describe the
symptom a shipped default or a late ledger produces instead of one
install's dated readings; the reply-discipline and checkpoint docstrings
state the failure they prevent instead of the session that measured it.
test_empty_selector_is_the_rule_115_baseline is renamed for what it
checks: the no-forge baseline.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_services_forge.py

@@ -1,4 +1,4 @@
-"""Forge adapter contract tests (#2689) — the Gitea implementation against a
+"""Forge adapter contract tests — the Gitea implementation against a
 mocked transport, plus the configuration gate.
 
 httpx.MockTransport is the fake forge: the adapter takes an injectable
@@ -9,7 +9,7 @@ reproduce.
 
 The most load-bearing tests are the OFF ones: a user with no usable connection
 must get an empty selector, because every consumer treats that as "behave as
-if the module didn't exist" (rule #115 — the baseline user has no forge).
+if the module didn't exist" (the baseline user has no forge).
 DB-backed keyring behavior (get_forges: rows, the project pin, the admin-only
 env entry) lives in tests/test_integration_forge_keyring.py.
 """
@@ -175,9 +175,9 @@ def test_full_values_build_a_github_adapter():
     )
 
 
-# --- the selector (#2778): host-keyed resolution over a keyring ---------------
+# --- the selector: host-keyed resolution over a keyring ----------------------
 
-def test_empty_selector_is_the_rule_115_baseline():
+def test_empty_selector_is_the_no_forge_baseline():
     selector = ForgeSelector()
     assert not selector.configured
     assert selector.resolve(f"{BASE}/alice/widget") is None
@@ -204,7 +204,7 @@ def test_forge_error_taxonomy_is_catchable_as_one_family():
 
 def test_adapter_contract_surface():
     """Both adapters implement exactly this surface — the second
-    implementation is what proves it's a contract (#2693)."""
+    implementation is what proves it's a contract."""
     from scribe.services.forge import FORGE_KINDS, GitHubForge
 
     for cls in (GiteaForge, GitHubForge):
@@ -222,7 +222,7 @@ def test_forge_routes_registered_at_their_post_2778_homes():
     """Connections are USER settings; only the webhook secret stays admin.
     The old instance-wide /api/admin/forge endpoints must be GONE, not
     coexisting — a legacy config surface that still wrote admin settings
-    would silently configure nothing (rule #22: no dual path)."""
+    would silently configure nothing (one path, not two)."""
     from scribe.app import create_app
     from scribe.routes import admin as admin_routes
 
@@ -239,11 +239,10 @@ def test_forge_routes_registered_at_their_post_2778_homes():
 
 
 def test_settings_kv_surface_masks_the_webhook_secret():
-    """The generic /api/settings dump masked nothing — the admin endpoints'
-    masking was bypassable by reading the raw KV rows (found while wiring the
-    forge token; smtp_password had the same exposure). forge_token left the
-    KV with #2778 (keyring rows carry it now), so it is deliberately no
-    longer a secret KEY here."""
+    """The generic /api/settings dump masks secrets too — otherwise the admin
+    endpoints' masking is bypassable by reading the raw KV rows. The forge
+    token lives on keyring rows, not in the KV, so it is deliberately not a
+    secret KEY here."""
     from scribe.routes.settings import _SECRET_KEYS, _masked
 
     out = _masked({"forge_webhook_secret": "sec", "smtp_password": "pw", "theme": "dark"})
@@ -270,7 +269,7 @@ def test_config_has_the_docker_secret_channel():
         assert hasattr(Config, attr)
 
 
-# --- the GitHub adapter (#2693) ----------------------------------------------
+# --- the GitHub adapter -----------------------------------------------------
 # Same contract, second implementation. Where behavior below differs from the
 # Gitea tests above, that difference IS the adapter's job: API host mapping,
 # Bearer auth, the missing last_commit_sha, the codeload redirect.