ivanball · ivanball · Sep 26, 2026 · Sep 26, 2026
diff --git a/assets/data/search-index.json b/assets/data/search-index.json
diff --git a/docs-src/onboarding/00-dependency-manifest.md b/docs-src/onboarding/00-dependency-manifest.md
@@ -53,6 +53,8 @@ alias `using`s name a target whose bare name already matches (so they resolve re
 | 18 | 70 |
 | 19 | 1 |
 
+<a id="cycles"></a>
+
 ## Cycles (SCC size > 1): 46
 
 | Level | Size | Members |

diff --git a/docs-src/onboarding/00-index.md b/docs-src/onboarding/00-index.md
@@ -51,7 +51,7 @@ reference is allowed (functional cohesion can outrank strict progressive disclos
 cross-linked. Thirty-six dependency **cycles** exist (mutually-dependent types, e.g. an aggregate root and
 its child entity with bidirectional EF navigations); each is kept whole within a single group and
 called out where it occurs. They are listed in the
-[dependency manifest](00-dependency-manifest.md#cycles-scc-size--1-36). Three of them are
+[dependency manifest](00-dependency-manifest.md#cycles). Three of them are
 name-collision artifacts rather than real dependencies: the identically-named pairs
 `SelfHttpWarmupTask` (`MMCA.ADC.Engagement.Service/SelfHttpWarmupTask.cs:23` and
 `MMCA.ADC.Identity.Service/SelfHttpWarmupTask.cs:23`), `Priority`

diff --git a/docs-src/onboarding/99-coverage-audit.md b/docs-src/onboarding/99-coverage-audit.md
@@ -1191,7 +1191,7 @@ double-counted (each type maps to exactly one group).
 > - **Outside the type pipeline:** 5 of 5 `devops-*` chapters refreshed against ADC #222 (`dr-drill.yml` timeout 30 to 60 minutes, the UI host log in the E2E artifact, the audit-trail DML auditing and per-service cost tags in `main.bicep`, which also shifted every later `main.bicep` cite); `devops-testing` per-project counts reconciled to the inventory.
 >   - Coverage gap: unchanged; `MMCA.Common/Tests/Architecture/MMCA.Common.Architecture.Tests/Fixtures/observability-main.bicep` remains the logged exception.
 > - **CONCEPT-MAPS.md:** unchanged. The one mechanical flag ("four AI packages" against the 22-package total) was a false positive: four is the AI subset, and `MMCA.Common/FACTS.md` lists exactly those four.
-> - **Verification:** `verify.ps1`: **0 missing**, rollup contract **0 failures**, citation integrity **0 failures**, rubric **34/34**. A heading-anchor scan over the assembled chapters found 94 links to an anchor that does not exist; the 46 that pointed at an existing type in the wrong chapter (40 of them `RoleNames`, which lives in G23, not G08) or at the removed `IEventCascadeDeletionDomainService` were fixed. The remaining 48 predate this pass and are an open item: links to types removed in earlier sweeps (mostly earlier scoring-pipeline types, `ScoreEventSessionsHandler`, `AnthropicScoringService`, `SessionScoringProcessor`) plus family and generic headings whose slug the scan could not model.
+> - **Verification:** `verify.ps1`: **0 missing**, rollup contract **0 failures**, citation integrity **0 failures**, rubric **34/34**. `verify.ps1` gained a fourth check this pass, **anchor integrity**: every in-guide `#anchor` link must land on a heading id the renderer emits. Before it existed, a rougher scan had already fixed 46 links pointing at an existing type in the wrong chapter (40 of them `RoleNames`, which lives in G23, not G08). Its first run then found **591** dead links across 24,498. Most were two systematic classes, now repaired by `fixlinks.ps1` on every pass: 426 links to rolled-up test classes (catalogued by project, so never given a heading; they now link the per-project rollup table) and 128 to single members of a family section (now the family heading). The rest were renamed or re-slugged headings, fixed by hand, and the cycles link now uses a stable `#cycles` id. The same pass found a stale second copy of the per-project rollup table rendering above the current one (the rollup unit's id moved when the group grew); it was removed, and the rollup contract now fails on a duplicated row or a restated count that disagrees with the inventory. **26** links remain an open item, each naming a type that no longer exists in source (mostly the earlier scoring pipeline, `ScoreEventSessionsHandler`, `AnthropicScoringService`, `SessionScoringProcessor`, `SessionScoringQueue`): the prose around them predates this pass and needs re-authoring, not relinking.
 > - **Governance events:** none (no new group, no classifier rule). The primer ADR table already matches the 127-record index.
 
 ---
@@ -1266,7 +1266,7 @@ individually-sectioned types are covered by 2,554 `###` sections; the 70-type di
   [group-17](group-17-conference-domain.md); the `Address`/`Currency` value-object + converter pairs in
   [group-02](group-02-domain-building-blocks.md) (plus polyglot-fitness and the new localization/markup
   test cycles in [group-28](group-28-testing-infrastructure.md)). Full list:
-  [manifest](00-dependency-manifest.md#cycles-scc-size--1-16).
+  [manifest](00-dependency-manifest.md#cycles).
 - **Cross-group forward references are allowed and cross-linked.** Because group order is functional
   (not a strict global topological sort), some sections reference a first-party type whose home group
   comes later. These are correct **by construction**: every cross-link target is resolved through

diff --git a/docs-src/onboarding/group-02-domain-building-blocks.md b/docs-src/onboarding/group-02-domain-building-blocks.md
@@ -1477,7 +1477,7 @@ in it.
   with every `HasMaxLength` reading an `AddressInvariants` constant, `CustomerConfiguration.cs:47-73`);
   [`RegisterRequest`](group-08-auth.md#registerrequest) carries an optional `Address? Address = null`
   (`MMCA.Common/Source/Core/MMCA.Common.Shared/Auth/Requests/RegisterRequest.cs:18`); the
-  [`AddressLine1Rules<T>`](group-06-validation.md#addressline1rulest) family and
+  [`AddressLine1Rules<T>`](group-06-validation.md#addressline1rulest-addressline2rulest-cityrulest-countryrulest) family and
   [`AddressValidator`](group-06-validation.md#addressvalidator) validate the request-side shape.
 
 ### AddressInvariants
@@ -1513,7 +1513,7 @@ in it.
 - **Where it's used**: called from `Address.Create` (`Address.cs:78`); every max-length constant is
   read by `CustomerConfiguration` in Store Identity
   (`MMCA.Store/Source/Modules/Identity/MMCA.Store.Identity.Infrastructure/Persistence/EntityConfiguration/CustomerConfiguration.cs:47-73`)
-  and by the [`AddressLine1Rules<T>`](group-06-validation.md#addressline1rulest) family in the
+  and by the [`AddressLine1Rules<T>`](group-06-validation.md#addressline1rulest-addressline2rulest-cityrulest-countryrulest) family in the
   Application layer.
 
 ### EmailInvariants
@@ -1797,8 +1797,8 @@ in it.
   [`AuditSaveChangesInterceptor`](group-07-persistence-ef-core.md#auditsavechangesinterceptor)
   (`MMCA.Common/Source/Core/MMCA.Common.Infrastructure/Persistence/Interceptors/AuditSaveChangesInterceptor.cs:104-105`)
   and covered by
-  [`AuditableBaseEntityTests`](group-28-testing-infrastructure.md#auditablebaseentitytests) and
-  [`AuditableBaseEntityAdditionalTests`](group-28-testing-infrastructure.md#auditablebaseentityadditionaltests).
+  [`AuditableBaseEntityTests`](group-28-testing-infrastructure.md#per-project-test-rollup) and
+  [`AuditableBaseEntityAdditionalTests`](group-28-testing-infrastructure.md#per-project-test-rollup).
 - **Caveats / not-in-source**: the delete stamps are written only on a **transition** of the flag
   (`AuditSaveChangesInterceptor.cs:98-102`), so updating an already-deleted row keeps the stamps of
   the delete that produced it rather than refreshing them.
@@ -1966,9 +1966,9 @@ in it.
   which calls `RemoveDomainEvents` per captured entry
   (`MMCA.Common/Source/Core/MMCA.Common.Infrastructure/Persistence/Interceptors/DomainEventSaveChangesInterceptor.cs:371`).
   Covered by
-  [`AuditableAggregateRootEntityTests`](group-28-testing-infrastructure.md#auditableaggregaterootentitytests)
+  [`AuditableAggregateRootEntityTests`](group-28-testing-infrastructure.md#per-project-test-rollup)
   and
-  [`AuditableAggregateRootEntityAdditionalTests`](group-28-testing-infrastructure.md#auditableaggregaterootentityadditionaltests).
+  [`AuditableAggregateRootEntityAdditionalTests`](group-28-testing-infrastructure.md#per-project-test-rollup).
 - **Caveats / not-in-source**: `SetItems` and the child helpers operate purely on the in-memory
   collection. If an aggregate was loaded without its children included, `GetChildOrNotFound` returns
   `NotFound` for a child that exists in the database; nothing in this class detects that case.
@@ -2262,7 +2262,7 @@ in it.
   `MMCA.Store/Source/Modules/Sales/MMCA.Store.Sales.Domain/Orders/OrderInvariants.cs:28` and
   `MMCA.Store/Source/Modules/Catalog/MMCA.Store.Catalog.Domain/Products/ProductInvariants.cs:76`.
   Exercised directly by
-  [`CommonInvariantsTests`](group-28-testing-infrastructure.md#commoninvariantstests).
+  [`CommonInvariantsTests`](group-28-testing-infrastructure.md#per-project-test-rollup).
 - **Caveats / not-in-source**: `EnsureTimeZoneIsValid` resolves against the **host's** time zone
   database (`CommonInvariants.cs:268`), so an identifier valid on a Windows developer machine and an
   identifier valid on a Linux CI runner are not guaranteed to be the same set. Nothing in this file

diff --git a/docs-src/onboarding/group-03-querying-specifications.md b/docs-src/onboarding/group-03-querying-specifications.md
@@ -256,7 +256,7 @@ The fourth co-located type is [`EventUpcasterRegistry`](#eventupcasterregistry)
   `MMCA.ADC.Engagement.Application/LivePolls/DomainEventHandlers/LivePollVoteChangedHandler.cs:51`, and
   the SignalR publish processor
   `MMCA.ADC.Engagement.Infrastructure/Live/LiveChannelPublishProcessor.cs:45`. Its own behavior is
-  pinned by [`BestEffortTests`](group-28-testing-infrastructure.md#bestefforttests)
+  pinned by [`BestEffortTests`](group-28-testing-infrastructure.md#per-project-test-rollup)
   (`BestEffortTests.cs:13`).
 - **Caveats / not-in-source**: nothing here retries. A swallowed side effect is gone, not queued, so
   anything that must eventually happen belongs in the outbox
@@ -369,7 +369,7 @@ The fourth co-located type is [`EventUpcasterRegistry`](#eventupcasterregistry)
   (`MMCA.Common/Source/Core/MMCA.Common.Infrastructure/Messaging/Consumers/EventUpcasterStartupValidator.cs:27`
   calls `ResolveTerminalType` for that side effect), so a broken graph fails the host rather than the
   first message. Behavior is pinned by
-  [`EventUpcasterRegistryTests`](group-28-testing-infrastructure.md#eventupcasterregistrytests)
+  [`EventUpcasterRegistryTests`](group-28-testing-infrastructure.md#per-project-test-rollup)
   (identity at `:88` and `:187`, chain walking at `:116` and `:130`, envelope preservation at `:153`,
   and one test per constructor rejection at `:199`, `:211`, `:223`).
 - **Caveats / not-in-source**: the walk trusts declared types. An upcaster that returns an instance
@@ -673,9 +673,9 @@ The fourth co-located type is [`EventUpcasterRegistry`](#eventupcasterregistry)
   (`MMCA.Store/Source/Modules/Catalog/MMCA.Store.Catalog.Application/Categories/CategoryEntityQueryService.cs:21`,
   `MMCA.ADC/Source/Modules/Conference/MMCA.ADC.Conference.Application/Speakers/SpeakerEntityQueryService.cs:21`).
   Behavior is pinned by
-  [`EntityQueryServiceTests`](group-28-testing-infrastructure.md#entityqueryservicetests),
-  [`EntityQueryServiceProjectionTests`](group-28-testing-infrastructure.md#entityqueryserviceprojectiontests),
-  and [`EntityQueryServiceResolutionTests`](group-28-testing-infrastructure.md#entityqueryserviceresolutiontests).
+  [`EntityQueryServiceTests`](group-28-testing-infrastructure.md#per-project-test-rollup),
+  [`EntityQueryServiceProjectionTests`](group-28-testing-infrastructure.md#per-project-test-rollup),
+  and [`EntityQueryServiceResolutionTests`](group-28-testing-infrastructure.md#per-project-test-rollup).
 - **Caveats / not-in-source**: this class does not clamp the page size it *applies* (the clamp lives
   in [`EntityQueryPipeline`](#entityquerypipeline)'s `ApplyPaging`,
   `MMCA.Common/Source/Core/MMCA.Common.Application/Services/Query/EntityQueryPipeline.cs:274-284`),

diff --git a/docs-src/onboarding/group-04-events-outbox.md b/docs-src/onboarding/group-04-events-outbox.md
@@ -1962,10 +1962,10 @@ edge) are the primary references.
   whichever caller dispatched the event (the save-changes interceptor after `SaveChangesAsync`,
   [`InProcessEventBus`](#inprocesseventbus) or [`InProcessMessageBus`](#inprocessmessagebus), or the
   background [`OutboxProcessor`](#outboxprocessor)). The only subclass in the workspace today is
-  [`TestSafeDomainEventHandler`](group-28-testing-infrastructure.md#testsafedomaineventhandler)
+  [`TestSafeDomainEventHandler`](group-28-testing-infrastructure.md#per-project-test-rollup)
   (`MMCA.Common/Tests/Core/MMCA.Common.Application.Tests/DomainEvents/SafeDomainEventHandlerTests.cs:124`),
   driven by
-  [`SafeDomainEventHandlerTests`](group-28-testing-infrastructure.md#safedomaineventhandlertests),
+  [`SafeDomainEventHandlerTests`](group-28-testing-infrastructure.md#per-project-test-rollup),
   which pin the three behaviours: log **and** propagate, the log lands before the caller sees the
   exception, and `OperationCanceledException` passes through unlogged. The cross-module sibling for
   integration events is
@@ -2063,7 +2063,7 @@ edge) are the primary references.
   `UserDeletedPointsHandler`), and Store's `ProductVariantAddedHandler`
   (`MMCA.Store/Source/Modules/Sales/MMCA.Store.Sales.Application/Inventory/DomainEventHandlers/ProductVariantAddedHandler.cs:33`).
   Its behaviour is pinned by
-  [`ScopedIntegrationEventHandlerBaseTests`](group-28-testing-infrastructure.md#scopedintegrationeventhandlerbasetests).
+  [`ScopedIntegrationEventHandlerBaseTests`](group-28-testing-infrastructure.md#per-project-test-rollup).
   At runtime the subclasses are reached either through
   [`DomainEventDispatcher`](#domaineventdispatcher) in monolith mode or through
   [`IntegrationEventConsumer<TEvent>`](#integrationeventconsumertevent) in broker mode.