docs(6209): lesson links, design roles, version readout and endpoint, timestamp filters, settings defaults, opened ledger, surfaces

Eight more test files state their properties without issue, milestone and
rule numbers or dated regressions. The version tests describe what folding
the channel into the version breaks instead of the date it did; the surface
registry and settings-defaults tests state that floors move rather than
quoting the decision that made them move.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_version_readout.py

@@ -6,11 +6,10 @@ shells. They are deliberately few and deliberately about ONE property each,
 because a grep-shaped test that asserts a whole file's contents fails on every
 refactor and gets deleted.
 
-WHY THIS FILE EXISTS. #3298: with a deploy misbehaving, nothing on the instance
-could say which commit was serving it, and the one endpoint whose job that is
-answered with the name of a branch. The value was fixed then. This is the other
-half — the value reaching a person — and #3127 checklist 12 is specific about
-the way it goes wrong: *never let a blank stand in for `unknown`*. A readout
+WHY THIS FILE EXISTS. With a deploy misbehaving, the instance has to be able to
+say which commit is serving it. `/api/version` answers that; this is the other
+half — the value reaching a person — and it goes wrong one way in particular:
+*never let a blank stand in for `unknown`*. A readout
 that renders a plausible value it never received is worse than one that renders
 nothing, because it ends the investigation instead of starting it.
 """
@@ -25,9 +24,9 @@ FRONTEND = Path(__file__).resolve().parents[1] / "frontend" / "src"
 def test_something_actually_reads_the_version_endpoint():
     """The endpoint is not enough; something must ask it.
 
-    `/api/version` answered correctly for weeks with no caller — an endpoint
-    reachable only by someone who already knew to curl it. Rule 27: a
-    capability with no surface the operator can touch is not shipped.
+    An endpoint with no caller is reachable only by someone who already knows
+    to curl it, and a capability with no surface the operator can touch is
+    not shipped.
     """
     hits = [p for p in FRONTEND.rglob("*.ts") if "/api/version" in p.read_text()]
     assert hits, "nothing under frontend/src fetches /api/version"
@@ -52,8 +51,8 @@ def test_the_footer_does_not_default_to_a_plausible_version():
     decl = match.group(0)
     assert '"dev"' not in decl and "'dev'" not in decl, (
         f"appVersion defaults to a version-shaped literal: {decl}\n"
-        "A failed fetch would render as a real-looking version (#3127 "
-        "checklist 12). Start from a not-answered-yet value instead."
+        "A failed fetch would render as a real-looking version. "
+        "Start from a not-answered-yet value instead."
     )
 
 
@@ -75,7 +74,7 @@ def test_optional_version_fields_are_read_by_absence_not_falsiness():
 
 
 def test_the_version_request_carries_a_deadline():
-    """Rule 156. A wait with no deadline cannot report that it failed.
+    """A wait with no deadline cannot report that it failed.
 
     This readout is consulted when an instance is misbehaving, which is exactly
     when it may never answer. Without a deadline the surface sits on "still