Adopts the Open Knowledge Format v0.2 as the home for Lotti's architecture
documentation, at knowledge/.

Documentation is now split by audience: lib/features/*/README.md describes
what a feature does for a user, knowledge/ describes how it actually runs.
No fact is written twice.

The validator in tool/okf/ enforces OKF conformance and, more importantly,
that every code path a concept points at still exists. A rename that
invalidates the docs fails CI, so the person holding the context is the one
who fixes the prose.

This commit lands the infrastructure and the cross-cutting architecture
layer: bootstrap and DI, persistence, navigation, security and privacy,
logging, and platform/release. Feature migration follows.

Refs lotti3-arp

Six review findings, all real:

- Require stale_after and sources as house keys. Both were only validated
  when present, so a new concept could omit exactly the metadata that makes
  drift detectable.
- Guard the root index.md loadYaml. Invalid YAML there threw past the issue
  list and took the CLI down with a stack trace instead of reporting a
  file-scoped diagnostic.
- Scan reference-style link definitions. `[impl]: ../../lib/gone.dart` matched
  no pattern, so a dangling code pointer passed make okf_check. Footnote
  definitions stay excluded — §5.1 keys those to sources[].id and their body
  is prose.
- Validate real calendar dates and times. DateTime rolls out-of-range
  components over rather than rejecting them (2026-99-99 parses as 2034-06-07,
  99:99:99 as an instant four days later), so shape-only regexes accepted
  impossible metadata. Range-check first, then round-trip for day-of-month.
- Repoint the three remaining references to the moved sync document.
- Add the AI-config lifecycle diagram. That concept documents deleteConfig,
  hardDeleteConfig and restoreConfig as distinct transitions, and AGENTS.md —
  added in this PR — requires a diagram for a real state machine.

The test fixtures now build from one house-key block, so a future required
key is a single edit rather than thirty. Verified the new reference-link and
date tests fail with their fix removed.

…ance

Four further findings, all real:

- `sources[].resource` must be a non-empty *string*. `resource: 123` passed
  the presence check and was then skipped by _resourceTargets, which only
  yields strings — so a present entry could carry no usable attribution while
  make okf_check succeeded.
- A root index.md carrying a frontmatter mapping without `okf_version` emitted
  nothing, because the fallback warning only fires when the whole block is
  absent.
- Seven workflows listen on tag pushes, not six. The prose and the frontmatter
  description disagreed with the diagram directly below them, which already
  listed all seven.
- Refresh provenance dates for the files this branch itself modifies —
  AGENTS.md and the Makefile. A bundle whose selling point is honest
  provenance should not ship with dates its own commit invalidated.

The moved sync document keeps 2026-05-30: the rename changed its path and not
one byte of its content, so that remains its accurate content recency.

Both new guards are covered by tests verified to fail with the guard removed.

…or gaps

Three of these were assertions in the bundle that the code contradicts, which
is the failure mode this bundle exists to prevent:

- user_activity: I listed Daily OS as an activity-gate consumer. UserActivityGate
  has zero references in daily_os_next — DayProcessingRuntime drains on startup,
  outbox changes, retries and connectivity without waiting for idle. I inferred
  that consumer from the sync pattern rather than checking. Now stated as the
  real difference it is.
- onboarding: "skipping persists nothing" is wrong. The modal records
  welcomeSkipped, and the auto-show path writes the shown count and
  first-shown timestamp before opening. What a skip preserves is the grace
  period, not storage neutrality.
- celebration/checklists: "haptics always fire" is wrong as an absolute. The
  animation switches and reduce-motion do not silence haptics, but a separate
  haptics preference does, honoured via onCelebrate: null.

Plus a CI map that mis-described its own triggers (type-check has no path
filter; flatpak-foreign-deps filters PRs but not branch pushes), and a
celebration concept that repeated its README verbatim — the duplication the
split exists to prevent. Verbatim sentence overlap between the two is now zero.

Validator gaps closed:

- `sources: null` and `sources: []` both satisfied their checks while leaving a
  concept with no provenance.
- A bundle-absolute `sources[].resource` (`/domain/x.md`, legal per §6.2) was
  checked by nothing: validateRepoReferences skips `/` prefixes and the
  body-link scanner never sees frontmatter.
- Angle-bracket destinations `[t](<path with space>)` never matched the
  whitespace-free pattern, so a dangling pointer written that way passed.
- log.md heading validation now strips fences, as the link scanner already did,
  so a `## example` inside a fenced sample is not read as a heading.

51 tests. All five new ones verified to fail with their guard removed — two of
my first revert attempts silently failed to apply, so those checks were redone
rather than trusted.

The most important one is security-relevant. I wrote that API keys never touch
SQLite. AiConfigDb.saveConfig() persists a provider as jsonEncode(config.toJson())
and that map includes its apiKey, so provider keys live in ai_config.sqlite —
which the same concept correctly calls unencrypted at rest. A reader would have
derived the opposite threat model. Now stated as the asymmetry it is: Matrix
credentials are in the keychain, AI-provider keys are not, and moving them there
is hardening rather than a docs fix.

Four more claims the code contradicts:

- persistence: "every byte lives in SQLite" is wrong — audio and images are
  separate files read via getAudioPath/getFullImagePath, which my own speech
  concept already described. Backup and migration have to cover both.
- daily_os_next: StandaloneTag does not exist anywhere in lib. Task-linked is
  the marked case; standalone is the unmarked default. I copied this from the
  old README instead of checking.
- overview: twelve supported locales, not seven.
- shared-widgets: ModalUtils is not the only presentation path — the Daily OS
  planning modal and What's New call WoltModalSheet directly, the former because
  it needs a side panel rather than a dialog.

Also, per this PR's own README contract, the agents and sync READMEs now end at
their knowledge concept rather than at a supplemental reference; swept all 40 to
confirm. And the localization concept named five ARB catalogs as if they were
all twelve — it now states the full set and flags that AGENTS.md's required-edit
list is a subset.

Validator gaps closed: reference definitions accept angle-bracketed
destinations containing whitespace, and a spaced source is only exempted as a
§5.1 scope descriptor when it is not path-shaped — so `../../lib/missing
file.dart` is checked rather than waved through.

53 tests; both new ones verified to fail with their guard removed.

Found in a self-audit of the 'only'/'never' claims, not by review:
'installModel is the only path that downloads from Hugging Face' reads as
global, but the TTS feature fetches its own Supertonic model over a separate
path. Anyone auditing what reaches Hugging Face would have been misled.

Review round 5 on the OKF bundle.

Validator — each gap now has a test that fails with the guard reverted:

* Required house keys were checked for presence only, so `generated:` with
  nothing after the colon passed while carrying no provenance at all; every
  per-field validator treats YAML null like an absent key and stays silent.
  Empty values and non-string title/description are now reported.
* A relative `./missing.dart` source was checked by neither pass: the bundle
  pass looked only at `/`-prefixed resources, the repo pass only at targets
  escaping the bundle. Every path-shaped resource now goes through the bundle
  pass, which already defers escaping ones.
* A bare `missing.dart` was classified as a §5.1 scope descriptor and exempted
  from resolution; a filename-with-extension shape now counts as a path, with an
  extension bound so prose ending in a period stays exempt.
* Link titles in the single-quoted and parenthesised forms made the whole link
  match nothing, hiding the target inside it.
* log.md was the only .md file whose bundle-internal links nothing validated,
  though it is the file that links concepts most densely.
* `computation: false` satisfied §10.3's file form and suppressed the warning
  while pointing at nothing followable.
* An absolute bundle argument resolved every code pointer outside the checkout,
  so a clean bundle reported hundreds of drift errors purely from how it was
  invoked. Normalisation is now a pure, tested function.
* Four-space indented code blocks were scanned for links, so a documented link
  form inside one failed the check — the one failure mode worse than a miss,
  because it blocks a correct change.

Reverting each guard also exposed that index.md link validation had no test at
all; added.

Concepts — six claims the code contradicts:

* Onboarding is not the only writer of `automaticInferenceEnabled`; the category
  settings form owns it from then on, via a conditionally rendered switch. The
  same wrong exclusivity appeared in three concepts.
* Logging has no Insights sink and no in-app viewer — files are the only sink and
  `InsightType` is vestigial.
* Theme sync is arrival-based, not last-write-wins: the local setters never
  advance `THEME_PREFS_UPDATED_AT`. `dailyOsUserName` does advance its
  timestamp, so the two are not the mirror the code comment claims.
* Survey charts write too, through `PersistenceLogic.createSurveyEntry`; and the
  matrix has five variants, not the six I listed — there is no story-time chart.
* TTS synthesis is local, but the weights are not bundled: first speak downloads
  six files from Hugging Face.
* The repaint-rainbow maintenance row hardcodes English, contradicting the
  localization boundary the same concept asserts. Documented as the unfixed
  oversight it is rather than changing 11 locales' UI in a docs PR.

Adds a stateDiagram-v2 for the notification mark lifecycle, which the repo's own
rule requires for a real state machine.

…t claims

Review round 6 on the OKF bundle.

Validator: a concept whose `sources` all point inside the bundle passed both
passes — the bundle check resolved the sibling file, the repo check skipped it for
staying inside `knowledge/`. That is the one shape whose drift is undetectable,
since a pointer at a sibling concept can never fail when the code moves, so it
defeats the reason `sources` is required at all. Now warns when *nothing* in
`sources` leaves the bundle. Deliberately permissive about what counts: a repo
path, an external URL and a §5.1 scope descriptor all qualify.

Concepts:

* Matrix access tokens do touch SQLite. `SecureStorage` holds only the config
  JSON needed to log in; `MatrixSdkDatabase.insertClient`/`updateClient` put
  `token`, `refreshToken` and `olmAccount` into the unencrypted
  `matrix/lotti_sync.db`. The keychain holds what is needed to log in, that file
  holds what is needed to stay logged in — an attacker with file access needs no
  password. Verified against matrix-8.1.0 rather than assumed.
* The security concept still said logs are "readable only in-app", contradicting
  the logging concept corrected in the previous commit. Restated as the tradeoff
  it actually is: no screen can leak log content, and no screen can show it
  either, so helping with a bug means exporting files.
* The architecture index said six release pipelines where the release concept
  says seven; seven workflows listen on tag pushes.
* `JournalEntity` is not every piece of user data — what the user *configures* is
  `EntityDefinition`, syncing as its own message family, and settings and agent
  state sit outside both. Coverage that walks only `JournalEntity` is incomplete
  by construction, which is the kind of thing backup and migration work reads
  this concept to decide.
* The activity gate does not make the start race-free. `waitUntilIdle()` awaits
  one idle edge and takes no lease, registers no cancellation hook and excludes
  nothing afterwards, so a user resuming just after the edge gets their input
  during a large apply exactly as before. The concept now bounds the promise at
  "delays work to an idle edge, and nothing more".