docs(api): one copy of each rule, an implementer path, honk config in the notes

[Zakkaus]

Final acceptance, part F2: make the contract docs shorter to read and easier to start from. It changes no status codes and no wire shapes. The only api/ edits are the replaceConfigSource description and the masked config example; the schema and HTTP changes are in F1, and this branch rebases after F1 merges.

Per item

1. One copy of each rule (A5, O10, O11, O12).
   • errors.md had two status tables; it now has one, with the fuller wording from the second.
   • Page cursors stay in errors.md, and the cursor restatements in dns-cache.md and flows.md now link there.
   • Replay stays in operations.md. configuration.md and the replay step in errors.md link to it.
   • SSE recovery stays in events.md. Its two stream.ready bullets are merged, and logs.md lists only the ways log streams differ. For logs.md to rely on events.md, events.md now also says that a cursor sent with changed filters returns 409 event_cursor_expired, which covers O7.
   • The CORS header list and the preflight rule moved from events.md to the listener rules in api-config.md.
   • The second path-conflict 409 in configuration.md is gone.
   • honk's geodata lifecycle values now appear only in honk-notes.md.
   • The replaceConfigSource description is now a short summary with a link to configuration.md#Editing.
2. Newcomer path (A16, O15, O17). index.md now has an "Implementing an engine" section with this reading order: discovery and auth, then the base profile (version, capabilities, runtime), then errors, visibility and operations, then optional resources. The hypothetical api {} block, the npm build steps and the Clash-compatible promise are gone from index.md. For building, it points to the README.
3. Terminology (A19, O18, O19). index.md has a terms table: engine, server, instance, runtime and datapath generation, configuration revision, source hash, accepted snapshot, configuration store, admitted caller, principal, flow ID and connection ID. In the docs, "adapter" and "backend" become "engine" for the product and "server" for the HTTP role. "dae text" becomes "engine-native text". The ebpf.backend field name is unchanged.
4. honk config out of normative pages (O5). honk-notes.md has a new "Listener configuration in honk" section for experimental.native_api, clash_api, /ui/, the separate listeners and honk's secret key names. It also records which geodata fields honk's configuration file can set. The normative text in api-config.md, configuration.md (the "Honk mapping" section), flows.md and geodata.md is now engine-neutral. The GET /config and source examples now mask a neutral api { secret } block. bytes stays 90, and line_count is now 6.
5. Delete (A4, O13, O14). Removed: design/honk-evidence-780c3f1.md, source/_posts/hello-world.md, _config.landscape.yml, scaffolds/, and the hexo-theme-landscape dependency and its lockfile entry (via yarn remove). _config.yml now has the right title, subtitle, description and author.
6. Navigation (A17, A18). The sidebar follows the reading path and lists every docs page, including Logs, Providers, Geodata and Rules. The "(Deferred)" label is gone. The README runs git submodule update --init --recursive before the build.
7. Renames (O16). docs/node-latency.md is now nodes.md and docs/check-nodes.md is now probes.md. Links and the navigation are updated.
8. Small corrections.
   • runtime-status.md: generation.active_id stays unchanged only when a reload fails before publication. The page links to activation outcomes (A13).
   • events.md: changed-filter cursors return 409 (O7, in the first commit).
   • errors.md: one sentence explains why a page cursor is 410 and an event cursor is 409; the statuses are unchanged (O6).
   • groups.md: names dae's tcp_check_http_method and udp_check_dns under config["x-dae"], next to check_addresses (O20). dae already has these three keys on Group in config/config.go.
   • flows.md: the recorder implementation advice is now a non-normative note (O25).

Not done

• _config.yml url is still http://example.com. The repository has no GitHub Pages site and no deploy workflow, so no real URL exists yet. The maintainers (CODEOWNERS) need to choose one.
• The cursor and idempotency descriptions in api/common.yaml and the stream.ready wording in api/events.yaml still repeat rules the docs define. A follow-up can shorten them.
• "dae-format" wording for source content and the fixed doc path in the OpenAPI link are unchanged.

Review fixes

Rebased onto honk after #42. Conflicts kept #42's rules: the 405 and If-Match statuses in errors.md, the RFC 9110 If-Match evaluation and source ETag in configuration.md, the content-only source example, and the non-loopback listener rule (deployment secret or password authentication, plus TLS).

• Source examples: bytes is 60 to match the 6-line content. check-contract.mjs now fails an example whose bytes differs from the UTF-8 length of its content.
• Schema descriptions say "engine" (or "server" for the HTTP role) where they said "adapter" or "backend", and "engine-native text" for "dae text". The honk key names in secrets_redacted and the honk sentence under verify_checksum are gone; the honk notes already hold both.
• probes.md drops the sentence about the removed pages. configuration.md states again that creation returns 409 for a path in use before it validates the content. groups.md no longer names honk for nested group selection.
• Copy: index.md intro, reading path (step-4 resources are optional for base; full_transparency also needs nodes, groups, connections, recorded flows and events) and the source-hash term; api-config.md summary; the replaceConfigSource description (the reload operation commits the replacement, before or after activation); which events.md stream rules also cover logs; full honk key names in the honk notes.
• The site generates its home page again. Removing the sample post left hexo-generator-index with nothing to render, so the header's home link pointed at a missing page.

Checks

• yarn install --frozen-lockfile && yarn check:contract: passes (87 tests; bundle regenerated and committed).
• yarn build (hexo clean && hexo generate): passes, including scripts/check-links.js.
• A separate script checked every internal link and #fragment in the generated HTML: 2930 links, 0 unresolved.