diff --git a/.github/GOVERNANCE.md b/.github/GOVERNANCE.md
index 64ba5f6..15da3f4 100644
--- a/.github/GOVERNANCE.md
+++ b/.github/GOVERNANCE.md
@@ -46,7 +46,7 @@ release schedules, contributor access, and community standards.
 - ADR statuses: `proposed`, `accepted`, `deprecated`, `superseded`, `rejected`.
 - ADRs provide a historical record of why decisions were made and what alternatives
   were considered.
-- See `.machine_readable/6a2/META.a2ml` for the machine-readable ADR index.
+- See `.machine_readable/descriptiles/META.a2ml` for the machine-readable ADR index.
 
 ---
 
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index c46a4e0..65789e9 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -29,9 +29,9 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 
 ### As Applicable
 
-- [ ] `.machine_readable/6a2/STATE.a2ml` updated (if project state changed)
-- [ ] `.machine_readable/6a2/ECOSYSTEM.a2ml` updated (if integrations changed)
-- [ ] `.machine_readable/6a2/META.a2ml` updated (if architectural decisions changed)
+- [ ] `.machine_readable/descriptiles/STATE.a2ml` updated (if project state changed)
+- [ ] `.machine_readable/descriptiles/ECOSYSTEM.a2ml` updated (if integrations changed)
+- [ ] `.machine_readable/descriptiles/META.a2ml` updated (if architectural decisions changed)
 - [ ] Documentation updated for user-facing changes
 - [ ] `TOPOLOGY.md` updated (if architecture changed)
 - [ ] `CHANGELOG` or release notes updated
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index e1b2fb4..1551783 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -35,7 +35,7 @@ workflows:
         - 'actions/configure-pages@v6.0.0'
         - 'actions/deploy-pages@v5.0.1'
         - 'actions/upload-pages-artifact@v5.0.0'
-        - 'haskell-actions/setup@v2.12.0'
+        - 'haskell-actions/setup@v2.12.1'
     '.github/workflows/proofs.yml':
         - 'actions/cache@v6.1.0'
         - 'actions/checkout@v7.0.1'
@@ -145,9 +145,9 @@ dependencies:
         commit: 'sha1-1fc58d04a4d4374f921bdac573c3811c240f9c26'
         owner_id: 9919
         repo_id: 259445878
-    'haskell-actions/setup@v2.12.0':
-        ref: 'v2.12.0'
-        commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d'
+    'haskell-actions/setup@v2.12.1':
+        ref: 'v2.12.1'
+        commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
         owner_id: 75048950
         repo_id: 623796603
     'hyperpolymath/smtp-notify-action@v0.5.1':
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index c77face..69ddfdd 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 #
 # OPTIONAL: BoJ Server Build Trigger
 # This workflow notifies a BoJ Server instance when code is pushed.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 48d54a4..ef37fe5 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: CodeQL Security Analysis
 on:
   push:
diff --git a/.github/workflows/container-build.yml b/.github/workflows/container-build.yml
index a497f6e..333277f 100644
--- a/.github/workflows/container-build.yml
+++ b/.github/workflows/container-build.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: container build
 on:
   pull_request:
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index d064cf0..97f905a 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 #
 # dependabot-automerge.yml — enable GitHub's native auto-merge on
 # Dependabot pull requests that match a declared severity / ecosystem
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index fc21609..5646a37 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 0481d51..1df3430 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # RSR Standard E2E + Aspect + Benchmark Workflow Template
@@ -63,8 +63,7 @@ jobs:
 #   name: E2E — Full Pipeline
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: dtolnay/rust-toolchain@stable
 #     - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5  # v2
@@ -77,12 +76,10 @@ steps:
 #   name: E2E — FFI Pipeline
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406  # v2.2.1
-#
-with:
+#       with:
 #         version: 0.15.1
 #     - run: cd ffi/zig && zig build test
 #     - run: bash tests/e2e.sh
@@ -92,12 +89,10 @@ with:
 #   name: E2E — Full Pipeline
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93  # v1.24.0
-#
-with:
+#       with:
 #         otp-version: '27.0'
 #         elixir-version: '1.17'
 #     - run: mix deps.get && mix compile --warnings-as-errors
@@ -108,12 +103,10 @@ with:
 #   name: E2E — Full Pipeline
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282  # v2.0.4
-#
-with:
+#       with:
 #         deno-version: v2.x
 #     - run: deno install --node-modules-dir=auto
 #     - run: deno task res:build  # ReScript compile
@@ -124,25 +117,21 @@ with:
 #   name: Playwright — ${{ matrix.project }}
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 20
-#
-strategy:
+#   strategy:
 #     fail-fast: false
 #     matrix:
 #       project: [chromium-1080p, firefox-1080p, webkit-1080p]
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282  # v2.0.4
-#
-with:
+#       with:
 #         deno-version: v2.x
 #     - run: deno install --node-modules-dir=auto
 #     - run: npx playwright install --with-deps
 #     - run: npx playwright test --project=${{ matrix.project }}
 #     - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
 #       if: failure()
-#
-with:
+#       with:
 #         name: playwright-traces-${{ matrix.project }}
 #         path: test-results/**/trace.zip
 #         retention-days: 7
@@ -152,12 +141,10 @@ with:
 #   name: E2E — Full Pipeline
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553  # v2.11.0
-#
-with:
+#       with:
 #         ghc-version: '9.6'
 #         cabal-version: '3.10'
 #     - run: cabal build all
@@ -171,8 +158,7 @@ with:
 #   name: Aspect — Architectural Invariants
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 10
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - run: bash tests/aspect_tests.sh
 
@@ -184,16 +170,14 @@ steps:
 #   name: Bench — Performance Regression
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: dtolnay/rust-toolchain@stable
 #     - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5  # v2
 #     - run: cargo bench 2>&1 | tee /tmp/bench-results.txt
 #     - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
 #       if: always()
-#
-with:
+#       with:
 #         name: benchmark-results
 #         path: /tmp/bench-results.txt
 #         retention-days: 30
@@ -203,12 +187,10 @@ with:
 #   name: Bench — Performance Regression
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 15
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406  # v2.2.1
-#
-with:
+#       with:
 #         version: 0.15.1
 #     - run: cd ffi/zig && zig build bench
 
@@ -219,8 +201,7 @@ with:
 #   name: Readiness — Grade D/C/B
 #   runs-on: ubuntu-latest
 #   timeout-minutes: 10
-#
-steps:
+#   steps:
 #     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 #     - uses: dtolnay/rust-toolchain@stable
 #     - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5  # v2
diff --git a/.github/workflows/estate-rules.yml b/.github/workflows/estate-rules.yml
index 118914f..4392b0d 100644
--- a/.github/workflows/estate-rules.yml
+++ b/.github/workflows/estate-rules.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Estate Rules — enforces hyperpolymath estate-wide conventions:
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 2dcc276..c06b0ef 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Governance
 
 on:
diff --git a/.github/workflows/guix-policy.yml b/.github/workflows/guix-policy.yml
index 0a41426..ab63a0e 100644
--- a/.github/workflows/guix-policy.yml
+++ b/.github/workflows/guix-policy.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Guix Package Policy
 on:
   push:
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 61ce294..f4b6842 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 #
 # Standalone Hypatia security scan (push / PR / weekly). This is NOT a duplicate
 # of the `hypatia-scan` job in `static-analysis-gate.yml`: that job exists to
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index 38c7111..01cbb73 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
 on:
diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml
index 814a192..fc79947 100644
--- a/.github/workflows/label-triage.yml
+++ b/.github/workflows/label-triage.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Label Triage
 
 # Classify newly-filed issues against the estate label taxonomy.
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 83ab941..af34c6b 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Labels
 
 # Applies the canonical estate label set from .github/labels.json.
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index e90d18e..364998c 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Mirror to Git Forges
 on:
   push:
diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml
index 26d7a8e..0984898 100644
--- a/.github/workflows/openssf-compliance.yml
+++ b/.github/workflows/openssf-compliance.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # OpenSSF Best Practices compliance gate — blocks PRs and pushes that lack
 # required files or still contain unfilled placeholder tokens.
 name: OpenSSF Compliance
@@ -73,11 +73,11 @@ jobs:
             exit 1
           fi
 
-          if [ ! -f ".machine_readable/6a2/STATE.a2ml" ]; then
-            echo "::error::.machine_readable/6a2/STATE.a2ml is required"
+          if [ ! -f ".machine_readable/descriptiles/STATE.a2ml" ]; then
+            echo "::error::.machine_readable/descriptiles/STATE.a2ml is required"
             exit 1
           fi
-          echo ".machine_readable/6a2/STATE.a2ml: OK"
+          echo ".machine_readable/descriptiles/STATE.a2ml: OK"
       - name: Check CHANGELOG exists
         run: |
           if [ ! -f "CHANGELOG.md" ] && [ ! -f "CHANGELOG.adoc" ] && [ ! -f "CHANGES.md" ]; then
@@ -93,8 +93,8 @@ jobs:
           # Collect all required files that exist
           for f in SECURITY.md SECURITY.adoc .github/SECURITY.md LICENSE LICENSE.txt \
                    CONTRIBUTING.md CONTRIBUTING.adoc README.md README.adoc \
-                   .machine_readable/6a2/STATE.a2ml .machine_readable/6a2/META.a2ml \
-                   .machine_readable/6a2/ECOSYSTEM.a2ml CHANGELOG.md CHANGELOG.adoc; do
+                   .machine_readable/descriptiles/STATE.a2ml .machine_readable/descriptiles/META.a2ml \
+                   .machine_readable/descriptiles/ECOSYSTEM.a2ml CHANGELOG.md CHANGELOG.adoc; do
             [ -f "$f" ] && REQUIRED_FILES="$REQUIRED_FILES $f"
           done
 
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index fb3ddbd..3899627 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # GitHub Pages via casket-ssg (hyperpolymath's pure-Haskell static site generator).
 # Replaces the orphan one-off Pages deployment with a reproducible build.
 name: GitHub Pages
diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml
index 832aee7..99960e3 100644
--- a/.github/workflows/proofs.yml
+++ b/.github/workflows/proofs.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Proof gate: the same scripts/check-proofs.sh a developer runs locally.
 # Hermetic by construction — elan comes from a version-pinned release tarball
 # with a checksum, the Lean toolchain from the committed lean-toolchain file,
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index b846a76..5318783 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -1,6 +1,6 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Dormant push-email notification. ARMED by setting the repo variable
 # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
 # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 5af32f9..941a8f3 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Code Quality
 on:
   push:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 80041b9..e127e0a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Release workflow — triggered by version tags (v*).
diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml
index 3979fb6..a5f649a 100644
--- a/.github/workflows/rhodibot.yml
+++ b/.github/workflows/rhodibot.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # rhodibot.yml — RSR compliance CANARY (report-only)
 #
 # Rhodibot does NOT mutate this repository. It never deletes, renames,
diff --git a/.github/workflows/runtime-policy.yml b/.github/workflows/runtime-policy.yml
index 7d67d18..6881682 100644
--- a/.github/workflows/runtime-policy.yml
+++ b/.github/workflows/runtime-policy.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Runtime and package-manager policy check.
 #
 # Authority: hyperpolymath/standards LANGUAGE-POLICY.adoc §1.
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index 6fb5a01..bcdc9bd 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Rust CI — thin wrapper calling the shared estate reusable in
 # hyperpolymath/standards. Configure once, propagate everywhere.
 # See: docs/CI-REUSABLE-WORKFLOWS.adoc in standards.
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b161eeb..20a58b5 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: OSSF Scorecard
 
 on:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 5324c71..432ec78 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Secret Scanner
 on:
   pull_request:
diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml
index 0793bec..d8e11ba 100644
--- a/.github/workflows/security-policy.yml
+++ b/.github/workflows/security-policy.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Security Policy
 on:
   push:
diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml
index a44effb..e23c265 100644
--- a/.github/workflows/sonarqube.yml
+++ b/.github/workflows/sonarqube.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # SonarQube Cloud (SonarCloud) static analysis. Analysis scope + exclusions live
 # in sonar-project.properties. Requires the SONAR_TOKEN repository secret
 # (Settings -> Secrets and variables -> Actions) and a SonarCloud project:
diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml
index 16bb1fd..3170817 100644
--- a/.github/workflows/static-analysis-gate.yml
+++ b/.github/workflows/static-analysis-gate.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Static Analysis Gate — Required by branch protection rules.
 # Runs panic-attack and hypatia, deposits findings for gitbot-fleet learning.
 name: Static Analysis Gate
diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml
index fd68126..128c448 100644
--- a/.github/workflows/wellknown-enforcement.yml
+++ b/.github/workflows/wellknown-enforcement.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Well-Known Standards (RFC 9116 + RSR)
 on:
   push:
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index 4523c3c..6cac0f6 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -1,7 +1,7 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # workflow-linter.yml - Validates GitHub workflows against RSR security standards
 # This workflow can be copied to other repos for consistent enforcement
 name: Workflow Security Linter
diff --git a/.machine_readable/0.1-AI-MANIFEST.a2ml b/.machine_readable/0.1-AI-MANIFEST.a2ml
index 7d8ce9e..a28ee37 100644
--- a/.machine_readable/0.1-AI-MANIFEST.a2ml
+++ b/.machine_readable/0.1-AI-MANIFEST.a2ml
@@ -12,14 +12,14 @@ description: |
   automation scripts.
 
 canonical_locations:
-  state: "6a2/STATE.a2ml"
-  meta: "6a2/META.a2ml"
-  ecosystem: "6a2/ECOSYSTEM.a2ml"
-  agentic: "6a2/AGENTIC.a2ml"
-  neurosym: "6a2/NEUROSYM.a2ml"
-  playbook: "6a2/PLAYBOOK.a2ml"
-  clade: "6a2/CLADE.a2ml"
-  anchors: "6a2/anchors/"
+  state: "descriptiles/STATE.a2ml"
+  meta: "descriptiles/META.a2ml"
+  ecosystem: "descriptiles/ECOSYSTEM.a2ml"
+  agentic: "descriptiles/AGENTIC.a2ml"
+  neurosym: "descriptiles/NEUROSYM.a2ml"
+  playbook: "descriptiles/PLAYBOOK.a2ml"
+  clade: "descriptiles/CLADE.a2ml"
+  anchors: "descriptiles/anchors/"
   policies: "policies/"
   ai_configs: "ai/"
   compliance: "compliance/"
diff --git a/.machine_readable/ai/.clinerules b/.machine_readable/ai/.clinerules
index 4818351..32565bc 100644
--- a/.machine_readable/ai/.clinerules
+++ b/.machine_readable/ai/.clinerules
@@ -2,7 +2,7 @@
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 # Authoritative source: docs/AI-CONVENTIONS.md
 
-# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/6a2/STATE.a2ml.
+# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/descriptiles/STATE.a2ml.
 
 # LICENSE
 # All original code: MPL-2.0.
diff --git a/.machine_readable/ai/.windsurfrules b/.machine_readable/ai/.windsurfrules
index 4818351..32565bc 100644
--- a/.machine_readable/ai/.windsurfrules
+++ b/.machine_readable/ai/.windsurfrules
@@ -2,7 +2,7 @@
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 # Authoritative source: docs/AI-CONVENTIONS.md
 
-# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/6a2/STATE.a2ml.
+# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/descriptiles/STATE.a2ml.
 
 # LICENSE
 # All original code: MPL-2.0.
diff --git a/.machine_readable/ai/AI.a2ml b/.machine_readable/ai/AI.a2ml
index 3754aca..ed3cd3c 100644
--- a/.machine_readable/ai/AI.a2ml
+++ b/.machine_readable/ai/AI.a2ml
@@ -7,8 +7,8 @@
 - Prefer to keep generated files out of source control, and regenerate them with the documented commands before committing.
 
 ## Workflow
-1. Inspect `.machine_readable/6a2/STATE.a2ml` for blockers and next actions.
-2. Respect any constraints listed inside `.machine_readable/6a2/AGENTIC.a2ml` when tooling changes are requested.
+1. Inspect `.machine_readable/descriptiles/STATE.a2ml` for blockers and next actions.
+2. Respect any constraints listed inside `.machine_readable/descriptiles/AGENTIC.a2ml` when tooling changes are requested.
 3. After finishing edits, update STATE with your outcomes and commit with a concise, imperative message.
 
 ## Delivery Promises
diff --git a/.machine_readable/ai/README.adoc b/.machine_readable/ai/README.adoc
index 29d3c06..a5dec59 100644
--- a/.machine_readable/ai/README.adoc
+++ b/.machine_readable/ai/README.adoc
@@ -16,9 +16,9 @@ Avoid scattering agent instruction files around the repo root.
 
 Recommended machine read order:
 
-* `.machine_readable/6a2/anchors/ANCHOR.a2ml`
+* `.machine_readable/descriptiles/anchors/ANCHOR.a2ml`
 * `.machine_readable/policies/MAINTENANCE-AXES.a2ml`
 * `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml`
 * `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml`
-* `.machine_readable/6a2/STATE.a2ml`
-* `.machine_readable/6a2/META.a2ml`
+* `.machine_readable/descriptiles/STATE.a2ml`
+* `.machine_readable/descriptiles/META.a2ml`
diff --git a/.machine_readable/arrival-pack/claude-md.k9.ncl b/.machine_readable/arrival-pack/claude-md.k9.ncl
index 969e8bf..d3fbb1c 100644
--- a/.machine_readable/arrival-pack/claude-md.k9.ncl
+++ b/.machine_readable/arrival-pack/claude-md.k9.ncl
@@ -34,11 +34,11 @@ K9!
   # Inputs the projection reads (single source of truth).
   inputs = {
     descriptiles = [
-      ".machine_readable/6a2/CLADE.a2ml",
-      ".machine_readable/6a2/ECOSYSTEM.a2ml",
-      ".machine_readable/6a2/AGENTIC.a2ml",
-      ".machine_readable/6a2/STATE.a2ml",
-      ".machine_readable/6a2/anchors/ANCHOR.a2ml",
+      ".machine_readable/descriptiles/CLADE.a2ml",
+      ".machine_readable/descriptiles/ECOSYSTEM.a2ml",
+      ".machine_readable/descriptiles/AGENTIC.a2ml",
+      ".machine_readable/descriptiles/STATE.a2ml",
+      ".machine_readable/descriptiles/anchors/ANCHOR.a2ml",
     ],
     estate_common = "hyperpolymath/manifesto@<pinned-sha>",  # DRAFT-unratified today
     target = "CLAUDE.md",
diff --git a/.machine_readable/arrival-pack/extract.sh b/.machine_readable/arrival-pack/extract.sh
index b77a8d5..c0adf70 100755
--- a/.machine_readable/arrival-pack/extract.sh
+++ b/.machine_readable/arrival-pack/extract.sh
@@ -13,7 +13,7 @@
 # Determinism (no timestamps) is required so the k9 drift check can byte-compare.
 set -euo pipefail
 
-DIR6A2="${1:-.machine_readable/6a2}"
+DIR6A2="${1:-.machine_readable/descriptiles}"
 CLADE="$DIR6A2/CLADE.a2ml"
 ECO="$DIR6A2/ECOSYSTEM.a2ml"
 AGENTIC="$DIR6A2/AGENTIC.a2ml"
diff --git a/.machine_readable/arrival-pack/generate.sh b/.machine_readable/arrival-pack/generate.sh
index 3caafa9..ac2a859 100755
--- a/.machine_readable/arrival-pack/generate.sh
+++ b/.machine_readable/arrival-pack/generate.sh
@@ -13,7 +13,7 @@ ROOT="$(git rev-parse --show-toplevel)"
 AP="$ROOT/.machine_readable/arrival-pack"
 TARGET="$ROOT/CLAUDE.md"
 
-bash "$AP/extract.sh" "$ROOT/.machine_readable/6a2" > "$AP/claude-md-data.json"
+bash "$AP/extract.sh" "$ROOT/.machine_readable/descriptiles" > "$AP/claude-md-data.json"
 nickel export --format raw "$AP/arrival-pack.ncl" > "$AP/.region.tmp"
 
 if [ -f "$TARGET" ] && grep -q 'ARRIVAL-PACK:BEGIN' "$TARGET"; then
diff --git a/.machine_readable/arrival-pack/verify.sh b/.machine_readable/arrival-pack/verify.sh
index 0763f00..1d90acf 100755
--- a/.machine_readable/arrival-pack/verify.sh
+++ b/.machine_readable/arrival-pack/verify.sh
@@ -13,7 +13,7 @@ TARGET="$ROOT/CLAUDE.md"
 
 [ -f "$TARGET" ] || { echo "DRIFT: CLAUDE.md missing — run \`just claude-md\`"; exit 1; }
 
-bash "$AP/extract.sh" "$ROOT/.machine_readable/6a2" > "$AP/claude-md-data.json"
+bash "$AP/extract.sh" "$ROOT/.machine_readable/descriptiles" > "$AP/claude-md-data.json"
 fresh="$(nickel export --format raw "$AP/arrival-pack.ncl")"
 committed="$(awk '/<!-- ARRIVAL-PACK:BEGIN/{f=1} f{print} /ARRIVAL-PACK:END/{f=0}' "$TARGET")"
 
diff --git a/.machine_readable/coaptation/coapt.k9.ncl b/.machine_readable/coaptation/coapt.k9.ncl
index 7cdc7ed..2c065bf 100644
--- a/.machine_readable/coaptation/coapt.k9.ncl
+++ b/.machine_readable/coaptation/coapt.k9.ncl
@@ -43,11 +43,11 @@ K9!
       ".machine_readable/contractiles/bust/Bustfile.a2ml",
     ],
     descriptiles = [
-      ".machine_readable/6a2/CLADE.a2ml",
-      ".machine_readable/6a2/STATE.a2ml",
-      ".machine_readable/6a2/ECOSYSTEM.a2ml",
-      ".machine_readable/6a2/AGENTIC.a2ml",
-      ".machine_readable/6a2/anchors/ANCHOR.a2ml",
+      ".machine_readable/descriptiles/CLADE.a2ml",
+      ".machine_readable/descriptiles/STATE.a2ml",
+      ".machine_readable/descriptiles/ECOSYSTEM.a2ml",
+      ".machine_readable/descriptiles/AGENTIC.a2ml",
+      ".machine_readable/descriptiles/anchors/ANCHOR.a2ml",
     ],
     witness_map = ".machine_readable/coaptation/witness-map.ncl",
     grades = ".machine_readable/coaptation/grades.ncl",
diff --git a/.machine_readable/coaptation/coapt.sh b/.machine_readable/coaptation/coapt.sh
index c6f31b3..a565339 100755
--- a/.machine_readable/coaptation/coapt.sh
+++ b/.machine_readable/coaptation/coapt.sh
@@ -21,7 +21,7 @@ MODE="${1:---report}"
 
 # Kennel (sense) -> deterministic atomised inputs.
 bash "$CO/extract-clauses.sh" "$ROOT/.machine_readable/contractiles" > "$CO/clauses.json"
-bash "$CO/extract-facts.sh"   "$ROOT/.machine_readable/6a2"           > "$CO/facts.json"
+bash "$CO/extract-facts.sh"   "$ROOT/.machine_readable/descriptiles"           > "$CO/facts.json"
 
 # Yard (compare, pure) -> receipt text.
 receipt="$(nickel export --format raw "$CO/coapt.ncl")"
diff --git a/.machine_readable/coaptation/extract-facts.sh b/.machine_readable/coaptation/extract-facts.sh
index b7d00c1..ac47fbc 100755
--- a/.machine_readable/coaptation/extract-facts.sh
+++ b/.machine_readable/coaptation/extract-facts.sh
@@ -16,7 +16,7 @@
 #                   "provenance": { <family>: <hash> } }
 set -euo pipefail
 
-DIR6A2="${1:-.machine_readable/6a2}"
+DIR6A2="${1:-.machine_readable/descriptiles}"
 CLADE="$DIR6A2/CLADE.a2ml"
 STATE="$DIR6A2/STATE.a2ml"
 ECO="$DIR6A2/ECOSYSTEM.a2ml"
diff --git a/.machine_readable/coaptation/verify.sh b/.machine_readable/coaptation/verify.sh
index c52474b..f749479 100755
--- a/.machine_readable/coaptation/verify.sh
+++ b/.machine_readable/coaptation/verify.sh
@@ -19,7 +19,7 @@ TARGET="$CO/receipts/latest.a2ml"
 [ -f "$TARGET" ] || { echo "DRIFT: coaptation receipt missing — run \`just coapt\`"; exit 1; }
 
 bash "$CO/extract-clauses.sh" "$ROOT/.machine_readable/contractiles" > "$CO/clauses.json"
-bash "$CO/extract-facts.sh"   "$ROOT/.machine_readable/6a2"           > "$CO/facts.json"
+bash "$CO/extract-facts.sh"   "$ROOT/.machine_readable/descriptiles"           > "$CO/facts.json"
 
 fresh="$(nickel export --format raw "$CO/coapt.ncl")"
 committed="$(cat "$TARGET")"
diff --git a/.machine_readable/coaptation/witness-map.ncl b/.machine_readable/coaptation/witness-map.ncl
index 9e7e489..f23dfc6 100644
--- a/.machine_readable/coaptation/witness-map.ncl
+++ b/.machine_readable/coaptation/witness-map.ncl
@@ -34,12 +34,12 @@
       { fact = "state.phase", op = 'present },
       { fact = "ecosystem.type", op = 'present },
     ],
-    note = "STATE.a2ml + ECOSYSTEM.a2ml were read from .machine_readable/6a2/",
+    note = "STATE.a2ml + ECOSYSTEM.a2ml were read from .machine_readable/descriptiles/",
   },
   "must.anchors-directory" = {
     kind = "descriptile",
     witnesses = [ { fact = "anchor.authority", op = 'present } ],
-    note = "ANCHOR.a2ml was read from .machine_readable/6a2/anchors/",
+    note = "ANCHOR.a2ml was read from .machine_readable/descriptiles/anchors/",
   },
 
   # --- TRUST: deliberately NO descriptile witness. ---
diff --git a/.machine_readable/contractiles/Justfile b/.machine_readable/contractiles/Justfile
index b98ac2c..968fa73 100644
--- a/.machine_readable/contractiles/Justfile
+++ b/.machine_readable/contractiles/Justfile
@@ -52,7 +52,7 @@ info:
     @echo "Version: {{version}}"
     @echo "RSR Tier: {{tier}}"
     @echo "Recipes: $(just --summary | wc -w)"
-    @[ -f ".machine_readable/6a2/STATE.a2ml" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/6a2/STATE.a2ml | head -1 | xargs -I{} echo "Phase: {}" || true
+    @[ -f ".machine_readable/descriptiles/STATE.a2ml" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/descriptiles/STATE.a2ml | head -1 | xargs -I{} echo "Phase: {}" || true
 
 # Run Invariant Path overlay tools for this repository
 invariant-path *ARGS:
@@ -415,14 +415,14 @@ import? "build/just/validate.just"
 
 # Update STATE.a2ml timestamp
 state-touch:
-    @if [ -f ".machine_readable/6a2/STATE.a2ml" ]; then \
-        sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/6a2/STATE.a2ml && \
+    @if [ -f ".machine_readable/descriptiles/STATE.a2ml" ]; then \
+        sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/descriptiles/STATE.a2ml && \
         echo "STATE.a2ml timestamp updated"; \
     fi
 
 # Show current phase from STATE.a2ml
 state-phase:
-    @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/6a2/STATE.a2ml 2>/dev/null | head -1 || echo "unknown"
+    @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/descriptiles/STATE.a2ml 2>/dev/null | head -1 || echo "unknown"
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # GUIX & NIX
diff --git a/.machine_readable/contractiles/adjust/adjust.k9.ncl b/.machine_readable/contractiles/adjust/adjust.k9.ncl
index 513a6e3..4974ba7 100644
--- a/.machine_readable/contractiles/adjust/adjust.k9.ncl
+++ b/.machine_readable/contractiles/adjust/adjust.k9.ncl
@@ -86,7 +86,7 @@ let base    = import "../_base.ncl" in
       { kind = 'verisimdb, table = "contractile_executions",
         schema = "contractile_execution_v1",
         aux_tables = [ "adjust_drift_history" ] },
-      { kind = 'drift_log, path = ".machine_readable/6a2/DRIFT.a2ml",
+      { kind = 'drift_log, path = ".machine_readable/descriptiles/DRIFT.a2ml",
         append_only = true },
     ],
 
@@ -141,7 +141,7 @@ let base    = import "../_base.ncl" in
             signature_required = true,
           },
         ],
-        signed_record_destination = ".machine_readable/6a2/ratification-<session-id>.a2ml",
+        signed_record_destination = ".machine_readable/descriptiles/ratification-<session-id>.a2ml",
         must_precede_work = true,
       },
 
diff --git a/.machine_readable/contractiles/bust/bust.k9.ncl b/.machine_readable/contractiles/bust/bust.k9.ncl
index a9fb9cf..4073727 100644
--- a/.machine_readable/contractiles/bust/bust.k9.ncl
+++ b/.machine_readable/contractiles/bust/bust.k9.ncl
@@ -50,6 +50,7 @@ let base    = import "../_base.ncl" in
       allow_network = false,
       allow_filesystem_write = false,
       allow_subprocess = true,
+      signature_required = true,        # K9-S008: required at 'Hunt
       probe_scope = 'read_only,
     },
   },
@@ -82,7 +83,7 @@ let base    = import "../_base.ncl" in
       { kind = 'verisimdb, table = "contractile_executions",
         schema = "contractile_execution_v1",
         aux_tables = [ "bust_triggers_history" ] },
-      { kind = 'drift_log, path = ".machine_readable/6a2/DRIFT.a2ml",
+      { kind = 'drift_log, path = ".machine_readable/descriptiles/DRIFT.a2ml",
         append_only = true },
     ],
 
@@ -135,7 +136,7 @@ let base    = import "../_base.ncl" in
             signature_required = true,
           },
         ],
-        signed_record_destination = ".machine_readable/6a2/ratification-<session-id>.a2ml",
+        signed_record_destination = ".machine_readable/descriptiles/ratification-<session-id>.a2ml",
         must_precede_work = true,
       },
 
diff --git a/.machine_readable/contractiles/dust/dust.k9.ncl b/.machine_readable/contractiles/dust/dust.k9.ncl
index f19cdd4..6c51e54 100644
--- a/.machine_readable/contractiles/dust/dust.k9.ncl
+++ b/.machine_readable/contractiles/dust/dust.k9.ncl
@@ -92,7 +92,7 @@ let base    = import "../_base.ncl" in
       { kind = 'verisimdb, table = "contractile_executions",
         schema = "contractile_execution_v1",
         aux_tables = [ "dust_retirement_history" ] },
-      { kind = 'drift_log, path = ".machine_readable/6a2/DRIFT.a2ml",
+      { kind = 'drift_log, path = ".machine_readable/descriptiles/DRIFT.a2ml",
         append_only = true },
     ],
 
@@ -145,7 +145,7 @@ let base    = import "../_base.ncl" in
             signature_required = true,
           },
         ],
-        signed_record_destination = ".machine_readable/6a2/ratification-<session-id>.a2ml",
+        signed_record_destination = ".machine_readable/descriptiles/ratification-<session-id>.a2ml",
         must_precede_work = true,
       },
 
diff --git a/.machine_readable/contractiles/intend/intend.k9.ncl b/.machine_readable/contractiles/intend/intend.k9.ncl
index 22af0b8..dd579a5 100644
--- a/.machine_readable/contractiles/intend/intend.k9.ncl
+++ b/.machine_readable/contractiles/intend/intend.k9.ncl
@@ -24,7 +24,7 @@ K9!
 #   (feedback_audit_tool_suppression_design.md — structural > markers).
 # * Sessional drift detection hooks (on_close, on_open).
 # * Ratification at session open; drift log at session close.
-# * Evidence sinks: VeriSimDB (queryable) + 6a2/DRIFT.a2ml (repo-local).
+# * Evidence sinks: VeriSimDB (queryable) + descriptiles/DRIFT.a2ml (repo-local).
 # * Failure-mode defenses cross-referenced to the AI failure catalog.
 
 let base_k9 = import "../k9/template-hunt.k9.ncl" in
@@ -64,6 +64,7 @@ let base    = import "../_base.ncl" in
       allow_network = false,
       allow_filesystem_write = false,   # evidence sinks are indirected
       allow_subprocess = true,
+      signature_required = true,        # K9-S008: required at 'Hunt
     },
   },
 
@@ -112,7 +113,7 @@ let base    = import "../_base.ncl" in
 
     # Evidence sinks — BOTH written, every execution.
     # VeriSimDB = queryable machine record (feedback_verisimdb_policy.md).
-    # 6a2/DRIFT.a2ml = repo-local append-only drift log (feedback_sessional_
+    # descriptiles/DRIFT.a2ml = repo-local append-only drift log (feedback_sessional_
     # drift_detection.md + user_6a2_is_contractile_ought.md descriptive role).
     evidence_sinks = [
       {
@@ -122,7 +123,7 @@ let base    = import "../_base.ncl" in
       },
       {
         kind        = 'drift_log,
-        path        = ".machine_readable/6a2/DRIFT.a2ml",
+        path        = ".machine_readable/descriptiles/DRIFT.a2ml",
         append_only = true,
       },
     ],
@@ -214,7 +215,7 @@ let base    = import "../_base.ncl" in
             # the AI is the holder of the line against enthusiasm drift.
           },
         ],
-        signed_record_destination = ".machine_readable/6a2/ratification-<session-id>.a2ml",
+        signed_record_destination = ".machine_readable/descriptiles/ratification-<session-id>.a2ml",
         must_precede_work = true,
       },
 
diff --git a/.machine_readable/contractiles/must/Mustfile.a2ml b/.machine_readable/contractiles/must/Mustfile.a2ml
index 55f8ab4..d269daf 100644
--- a/.machine_readable/contractiles/must/Mustfile.a2ml
+++ b/.machine_readable/contractiles/must/Mustfile.a2ml
@@ -62,13 +62,13 @@ hooks fail if any check fails.
 - severity: critical
 
 ### six-directory-present
-- description: 6a2 directory exists with required files
-- run: test -d .machine_readable/6a2 && test -f .machine_readable/6a2/META.a2ml && test -f .machine_readable/6a2/ECOSYSTEM.a2ml && test -f .machine_readable/6a2/STATE.a2ml && test -f .machine_readable/6a2/PLAYBOOK.a2ml && test -f .machine_readable/6a2/AGENTIC.a2ml && test -f .machine_readable/6a2/NEUROSYM.a2ml
+- description: descriptiles directory exists with required files
+- run: test -d .machine_readable/descriptiles && test -f .machine_readable/descriptiles/META.a2ml && test -f .machine_readable/descriptiles/ECOSYSTEM.a2ml && test -f .machine_readable/descriptiles/STATE.a2ml && test -f .machine_readable/descriptiles/PLAYBOOK.a2ml && test -f .machine_readable/descriptiles/AGENTIC.a2ml && test -f .machine_readable/descriptiles/NEUROSYM.a2ml
 - severity: critical
 
 ### anchors-directory
-- description: anchors directory exists in 6a2
-- run: test -d .machine_readable/6a2/anchors
+- description: anchors directory exists in descriptiles
+- run: test -d .machine_readable/descriptiles/anchors
 - severity: warning
 
 ### self-validating-structure
diff --git a/.machine_readable/contractiles/must/must.k9.ncl b/.machine_readable/contractiles/must/must.k9.ncl
index 2c653dc..38ba96d 100644
--- a/.machine_readable/contractiles/must/must.k9.ncl
+++ b/.machine_readable/contractiles/must/must.k9.ncl
@@ -58,6 +58,7 @@ let base    = import "../_base.ncl" in
       allow_network = false,
       allow_filesystem_write = false,
       allow_subprocess = true,
+      signature_required = true,        # K9-S008: required at 'Hunt
       probe_scope = 'read_only,              # must probes NEVER mutate
       probe_kinds_allowed = [
         'file_existence,
@@ -119,7 +120,7 @@ let base    = import "../_base.ncl" in
       },
       {
         kind        = 'drift_log,
-        path        = ".machine_readable/6a2/DRIFT.a2ml",
+        path        = ".machine_readable/descriptiles/DRIFT.a2ml",
         append_only = true,
       },
     ],
@@ -194,7 +195,7 @@ let base    = import "../_base.ncl" in
             signature_required = true,
           },
         ],
-        signed_record_destination = ".machine_readable/6a2/ratification-<session-id>.a2ml",
+        signed_record_destination = ".machine_readable/descriptiles/ratification-<session-id>.a2ml",
         must_precede_work = true,
       },
 
diff --git a/.machine_readable/contractiles/trust/trust.k9.ncl b/.machine_readable/contractiles/trust/trust.k9.ncl
index 104d2e3..7855e3c 100644
--- a/.machine_readable/contractiles/trust/trust.k9.ncl
+++ b/.machine_readable/contractiles/trust/trust.k9.ncl
@@ -39,7 +39,7 @@ K9!
 # * Plain-language translation — user never authors a Nickel schema for
 #   a cipher suite; AI does the spec work, user reviews in domain
 #   language ("TLS 1.3 with PQ key exchange, HSTS preload, 1yr").
-# * Evidence sinks: VeriSimDB (queryable) + 6a2/DRIFT.a2ml (repo-local).
+# * Evidence sinks: VeriSimDB (queryable) + descriptiles/DRIFT.a2ml (repo-local).
 # * Failure-mode defenses cross-referenced — trust carries the most
 #   defenses of any verb because the threat surface is widest.
 
@@ -76,6 +76,7 @@ let base    = import "../_base.ncl" in
       allow_network = false,            # verifications offline by default
       allow_filesystem_write = false,   # evidence sinks are indirected
       allow_subprocess = true,
+      signature_required = true,        # K9-S008: required at 'Hunt
       authorised_probes_only = true,    # probe section explicitly lists allowed targets + probe classes
       probe_scope_enforcement = 'this_repo_only,  # probes NEVER hit external systems
     },
@@ -143,7 +144,7 @@ let base    = import "../_base.ncl" in
       },
       {
         kind        = 'drift_log,
-        path        = ".machine_readable/6a2/DRIFT.a2ml",
+        path        = ".machine_readable/descriptiles/DRIFT.a2ml",
         append_only = true,
       },
     ],
@@ -233,7 +234,7 @@ let base    = import "../_base.ncl" in
             signature_required = true,
           },
         ],
-        signed_record_destination = ".machine_readable/6a2/ratification-<session-id>.a2ml",
+        signed_record_destination = ".machine_readable/descriptiles/ratification-<session-id>.a2ml",
         must_precede_work = true,
       },
 
diff --git a/.machine_readable/6a2/0-AI-MANIFEST.a2ml b/.machine_readable/descriptiles/0-AI-MANIFEST.a2ml
similarity index 81%
rename from .machine_readable/6a2/0-AI-MANIFEST.a2ml
rename to .machine_readable/descriptiles/0-AI-MANIFEST.a2ml
index a542ab6..b7738d1 100644
--- a/.machine_readable/6a2/0-AI-MANIFEST.a2ml
+++ b/.machine_readable/descriptiles/0-AI-MANIFEST.a2ml
@@ -1,8 +1,8 @@
-# AI Manifest for 6a2 Directory
+# AI Manifest for descriptiles Directory
 
 ## Purpose
 
-This manifest declares the AI-assistant context for the 6a2 machine-readable metadata directory.
+This manifest declares the AI-assistant context for the descriptiles machine-readable metadata directory.
 
 ## Canonical Locations
 
diff --git a/.machine_readable/6a2/AGENTIC.a2ml b/.machine_readable/descriptiles/AGENTIC.a2ml
similarity index 100%
rename from .machine_readable/6a2/AGENTIC.a2ml
rename to .machine_readable/descriptiles/AGENTIC.a2ml
diff --git a/.machine_readable/6a2/CLADE.a2ml b/.machine_readable/descriptiles/CLADE.a2ml
similarity index 100%
rename from .machine_readable/6a2/CLADE.a2ml
rename to .machine_readable/descriptiles/CLADE.a2ml
diff --git a/.machine_readable/6a2/ECOSYSTEM.a2ml b/.machine_readable/descriptiles/ECOSYSTEM.a2ml
similarity index 100%
rename from .machine_readable/6a2/ECOSYSTEM.a2ml
rename to .machine_readable/descriptiles/ECOSYSTEM.a2ml
diff --git a/.machine_readable/6a2/META.a2ml b/.machine_readable/descriptiles/META.a2ml
similarity index 100%
rename from .machine_readable/6a2/META.a2ml
rename to .machine_readable/descriptiles/META.a2ml
diff --git a/.machine_readable/6a2/NEUROSYM.a2ml b/.machine_readable/descriptiles/NEUROSYM.a2ml
similarity index 100%
rename from .machine_readable/6a2/NEUROSYM.a2ml
rename to .machine_readable/descriptiles/NEUROSYM.a2ml
diff --git a/.machine_readable/6a2/PLAYBOOK.a2ml b/.machine_readable/descriptiles/PLAYBOOK.a2ml
similarity index 95%
rename from .machine_readable/6a2/PLAYBOOK.a2ml
rename to .machine_readable/descriptiles/PLAYBOOK.a2ml
index 749b096..0da93f8 100644
--- a/.machine_readable/6a2/PLAYBOOK.a2ml
+++ b/.machine_readable/descriptiles/PLAYBOOK.a2ml
@@ -13,7 +13,7 @@ last-updated = "2026-04-11"
 # target = "container"  # container | binary | library | wasm
 
 [incident-response]
-# 1. Check .machine_readable/6a2/STATE.a2ml for current status
+# 1. Check .machine_readable/descriptiles/STATE.a2ml for current status
 # 2. Review recent commits and CI results
 # 3. Run `just validate` to check compliance
 # 4. Run `just security` to audit for vulnerabilities
@@ -58,14 +58,14 @@ enforcement-workflow = ".github/workflows/estate-rules.yml"
 # CHANGELOG.md         One of the recognised .md exceptions (see below)
 # Justfile             Task runner — self-contained (build/ scaffolding retired;
 #                      build/just/proofs.just returns with the proof gate)
-# coordination.k9      Repo-local session binding
+# coordination.k9.ncl  Repo-local session binding
 
 # === Required directories ===
 # .github/             CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, workflows/
-# .machine_readable/   AI manifests (0.1-AI-MANIFEST.a2ml), 6a2/ checkpoints,
+# .machine_readable/   AI manifests (0.1-AI-MANIFEST.a2ml), descriptiles/ checkpoints,
 #                      contractiles/, configs/, anchors/, policies/, scripts/, self-validating/
 # docs/                onboarding/, status/, architecture/, governance/  (all .adoc)
-# session/             dispatch.sh, custom-checks.k9, local-hooks.sh
+# session/             dispatch.sh, custom-checks.k9.ncl, local-hooks.sh
 # src/                 Project source (Idris2 ABI under abi/, Zig FFI under ffi/)
 # tests/, benches/, examples/, features/, scripts/, verification/, container/
 
diff --git a/.machine_readable/6a2/README.adoc b/.machine_readable/descriptiles/README.adoc
similarity index 97%
rename from .machine_readable/6a2/README.adoc
rename to .machine_readable/descriptiles/README.adoc
index 916a702..97414db 100644
--- a/.machine_readable/6a2/README.adoc
+++ b/.machine_readable/descriptiles/README.adoc
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: CC-BY-SA-4.0
 // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-# A2ML 6a2 Directory
+# A2ML descriptiles Directory
 
 This directory contains the 6 core A2ML machine-readable metadata files for this repository.
 
diff --git a/.machine_readable/6a2/STATE.a2ml b/.machine_readable/descriptiles/STATE.a2ml
similarity index 100%
rename from .machine_readable/6a2/STATE.a2ml
rename to .machine_readable/descriptiles/STATE.a2ml
diff --git a/.machine_readable/6a2/anchors/0-AI-MANIFEST.a2ml b/.machine_readable/descriptiles/anchors/0-AI-MANIFEST.a2ml
similarity index 100%
rename from .machine_readable/6a2/anchors/0-AI-MANIFEST.a2ml
rename to .machine_readable/descriptiles/anchors/0-AI-MANIFEST.a2ml
diff --git a/.machine_readable/6a2/anchors/ANCHOR.a2ml b/.machine_readable/descriptiles/anchors/ANCHOR.a2ml
similarity index 100%
rename from .machine_readable/6a2/anchors/ANCHOR.a2ml
rename to .machine_readable/descriptiles/anchors/ANCHOR.a2ml
diff --git a/.machine_readable/6a2/anchors/README.adoc b/.machine_readable/descriptiles/anchors/README.adoc
similarity index 100%
rename from .machine_readable/6a2/anchors/README.adoc
rename to .machine_readable/descriptiles/anchors/README.adoc
diff --git a/.machine_readable/policies/MAINTENANCE-AXES.a2ml b/.machine_readable/policies/MAINTENANCE-AXES.a2ml
index acd2f7b..851f125 100644
--- a/.machine_readable/policies/MAINTENANCE-AXES.a2ml
+++ b/.machine_readable/policies/MAINTENANCE-AXES.a2ml
@@ -18,7 +18,7 @@ machine-entrypoints = [
   ".machine_readable/policies/MAINTENANCE-AXES.a2ml",
   ".machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml",
   ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml",
-  ".machine_readable/6a2/META.a2ml",
+  ".machine_readable/descriptiles/META.a2ml",
   ".machine_readable/ai/README.adoc",
   ".machine_readable/bot_directives/README.scm",
 ]
diff --git a/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml b/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml
index 05bd4f6..7a15842 100644
--- a/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml
+++ b/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml
@@ -102,7 +102,7 @@ ownership_files = [
 ]
 
 machine_readable_required = [
-  ".machine_readable/6a2/anchors/ANCHOR.a2ml",
+  ".machine_readable/descriptiles/anchors/ANCHOR.a2ml",
   ".machine_readable/contractiles/",
   ".machine_readable/ai/",
   ".machine_readable/bot_directives/",
diff --git a/.machine_readable/root-allow.txt b/.machine_readable/root-allow.txt
index d6c81e8..e7316f2 100644
--- a/.machine_readable/root-allow.txt
+++ b/.machine_readable/root-allow.txt
@@ -30,7 +30,7 @@ CITATION.cff               # citation metadata (surfaced at root by #96)
 
 # ─── Build entry points (must live at root for their tooling) ────────────────
 Justfile                   # task runner entry point (self-contained since build/ scaffolding removal)
-coordination.k9            # repo-local session binding (template-mandated)
+coordination.k9.ncl        # repo-local session binding (template-mandated)
 
 # ─── Conventional dotfiles (tool-required at root) ───────────────────────────
 .editorconfig
@@ -55,7 +55,7 @@ docs/                      # onboarding/, status/, governance/, ...
 docs-template/             # template-only: scaffolding docs copied into new repos
 machine-readable-design/   # template-only: design rationale for .machine_readable/ layout
 .githooks/                 # vendored A2ML/K9 validation scripts run by the dogfood gate (PR #31); kept at root because git's core.hooksPath convention and the workflow both reference it there
-session/                   # dispatch.sh, custom-checks.k9, local-hooks.sh
+session/                   # dispatch.sh, custom-checks.k9.ncl, local-hooks.sh
 
 # Source / test / artifact trees (project-specific but conventional)
 # NB: src/ is deliberately NOT allowed — systemet is a theory repo (IS-NOT:
diff --git a/.machine_readable/self-validating/methodology-guard.k9.ncl b/.machine_readable/self-validating/methodology-guard.k9.ncl
index 4c43325..b82bcdf 100644
--- a/.machine_readable/self-validating/methodology-guard.k9.ncl
+++ b/.machine_readable/self-validating/methodology-guard.k9.ncl
@@ -1,5 +1,6 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
-# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # K9 Validator: Methodology Guard
 # Checks that agent work respects methodology constraints declared in
@@ -12,6 +13,18 @@ let methodology_guard = {
   version = "1.0.0",
   description = "Validates that agent work respects declared methodology constraints",
 
+  pedigree = {
+    schema_version = "1.0.0",
+    component_type = "validator:methodology-guard",
+    metadata = {
+      name = "methodology-guard",
+      version = "1.0.0",
+    },
+    security = {
+      leash = 'Yard,
+    },
+  },
+
   checks = {
     divergent_invariant_language = {
       description = "No files in languages violating the divergent language invariant",
@@ -43,7 +56,7 @@ let methodology_guard = {
     state_not_template = {
       description = "STATE.a2ml must not contain template placeholders",
       severity = "warning",
-      file = ".machine_readable/6a2/STATE.a2ml",
+      file = ".machine_readable/descriptiles/STATE.a2ml",
       # NOTE: the PROJECT token below is written as a Nickel concat
       # ("{{" ++ "PROJECT}}") ON PURPOSE. `just init` runs a sed substitution for
       # the brace-PROJECT-brace token over EVERY text file, which would otherwise
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index e31f5bf..bf6892f 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -59,4 +59,4 @@ repos:
         entry: bash .machine_readable/arrival-pack/verify.sh
         language: system
         pass_filenames: false
-        files: '^(\.machine_readable/6a2/.*|CLAUDE\.md)$'
+        files: '^(\.machine_readable/descriptiles/.*|CLAUDE\.md)$'
diff --git a/AFFIRMATION.adoc b/AFFIRMATION.adoc
index f3127c1..abf936b 100644
--- a/AFFIRMATION.adoc
+++ b/AFFIRMATION.adoc
@@ -33,7 +33,7 @@ command in the session that filled this anchor, against the anchor SHA.
 | *ADR-0002 is accepted*: ET-14's item (3) — the L0 observational equivalence — is fixed as the `≈` of a parametric `L0Observation`, and ET-16 enters the ledger narrowly | affirmed | `docs/decisions/0002-…adoc` (Status: Accepted), `docs/theory/OBLIGATIONS.adoc`
 | The proof gate FAILS on: broken proof, smuggled `axiom`, absent prover, unlisted proof file, status drift | affirmed-ran | watched-to-fail runs recorded in PR #17; drift gate `./scripts/check-proof-status.sh` — PASS
 | The golden path is real: `just test && just quality` runs the proof gates, scans, shape checks — no echo-stub greens | affirmed-ran | Justfile recipes wired to `scripts/*` (this PR); both PASS at the anchor SHA
-| The theory is the semantic authority; `anytype` is the implementation | affirmed | `.machine_readable/6a2/anchors/ANCHOR.a2ml`, `ECOSYSTEM.a2ml`; anytype pins systemet (its issue #13 tracks the pin refresh)
+| The theory is the semantic authority; `anytype` is the implementation | affirmed | `.machine_readable/descriptiles/anchors/ANCHOR.a2ml`, `ECOSYSTEM.a2ml`; anytype pins systemet (its issue #13 tracks the pin refresh)
 |===
 
 == What we do NOT claim
diff --git a/EXPLAINME.adoc b/EXPLAINME.adoc
index a6047a3..325dc12 100644
--- a/EXPLAINME.adoc
+++ b/EXPLAINME.adoc
@@ -149,7 +149,7 @@ profile.
 How this is kept honest:
 
 * systemet owns the semantics and is the *semantic authority* (see
-  `.machine_readable/6a2/anchors/ANCHOR.a2ml`). Downstream may *extend* but not
+  `.machine_readable/descriptiles/anchors/ANCHOR.a2ml`). Downstream may *extend* but not
   *redefine* the theory.
 * anytype must *pin* systemet upstream and implement it; it may not silently change
   the theory to match the implementation. If implementation pressure forces a
diff --git a/Justfile b/Justfile
index 30444c8..ce1cb88 100644
--- a/Justfile
+++ b/Justfile
@@ -48,7 +48,7 @@ info:
     @echo "Version: {{version}}"
     @echo "RSR Tier: {{tier}}"
     @echo "Recipes: $(just --summary | wc -w)"
-    @[ -f ".machine_readable/6a2/STATE.a2ml" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/6a2/STATE.a2ml | head -1 | xargs -I{} echo "Phase: {}" || true
+    @[ -f ".machine_readable/descriptiles/STATE.a2ml" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/descriptiles/STATE.a2ml | head -1 | xargs -I{} echo "Phase: {}" || true
 
 # Run Invariant Path overlay tools for this repository
 invariant-path *ARGS:
@@ -388,14 +388,14 @@ sbom:
 
 # Update STATE.a2ml timestamp
 state-touch:
-    @if [ -f ".machine_readable/6a2/STATE.a2ml" ]; then \
-        sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/6a2/STATE.a2ml && \
+    @if [ -f ".machine_readable/descriptiles/STATE.a2ml" ]; then \
+        sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/descriptiles/STATE.a2ml && \
         echo "STATE.a2ml timestamp updated"; \
     fi
 
 # Show current phase from STATE.a2ml
 state-phase:
-    @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/6a2/STATE.a2ml 2>/dev/null | head -1 || echo "unknown"
+    @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/descriptiles/STATE.a2ml 2>/dev/null | head -1 || echo "unknown"
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # HYBRID AUTOMATION
diff --git a/container/0.1-AI-MANIFEST.a2ml b/container/0.1-AI-MANIFEST.a2ml
index a25baa5..dc38a0d 100644
--- a/container/0.1-AI-MANIFEST.a2ml
+++ b/container/0.1-AI-MANIFEST.a2ml
@@ -38,7 +38,7 @@ canonical_locations:
   secrets_gate: "container/stapeln/rokur.toml"
   build_pipeline: "container/stapeln/ct-build.sh"
   monitoring: "container/stapeln/vordr.toml"
-  deployment: "container/stapeln/deploy.k9.ncl"
+  deployment: "container/stapeln/deploy.k9.ncl.in"
   # Just module + opt-out
   just_module: "none"  # build/just/container.just retired with the build/ scaffolding removal
 
@@ -101,7 +101,7 @@ files:
       detection, resource thresholds, and structured log output.
     depends_on: []
 
-  - name: "deploy.k9.ncl"
+  - name: "deploy.k9.ncl.in"
     role: "Deployment Component"
     description: |
       k9-svc deployment specification at Hunt trust level. Full pedigree
diff --git a/container/README.adoc b/container/README.adoc
index 7a2f805..364ab77 100644
--- a/container/README.adoc
+++ b/container/README.adoc
@@ -103,7 +103,7 @@ The container engine is *auto-detected* (`podman`, then `nerdctl`, then
 | *cerro-torre* build → pack → sign (Ed25519) → verify → push pipeline.
   Engine-agnostic; degrades gracefully when cerro-torre tools are absent.
 
-| `deploy.k9.ncl`
+| `deploy.k9.ncl.in`
 | *k9-svc* deployment component at Hunt trust level: full pedigree (L1–L5),
   dev/staging/prod configs, rolling deployment strategy.
 |===
@@ -176,6 +176,8 @@ k9-svc managed deployment:
 
 [source,bash]
 ----
+# deploy.k9.ncl.in is a template input. Fill its placeholders and save the result
+# as deploy.k9.ncl before you run these commands.
 nickel typecheck container/stapeln/deploy.k9.ncl
 k9-svc deploy container/stapeln/deploy.k9.ncl --env production
 ----
diff --git a/container/stapeln/deploy.k9.ncl b/container/stapeln/deploy.k9.ncl.in
similarity index 100%
rename from container/stapeln/deploy.k9.ncl
rename to container/stapeln/deploy.k9.ncl.in
diff --git a/coordination.k9 b/coordination.k9
deleted file mode 100644
index ba31125..0000000
--- a/coordination.k9
+++ /dev/null
@@ -1,43 +0,0 @@
-# Thin coordination bindings for central session-management standards
-
-session_management:
-  source_of_truth: "standards/session-management-standards"
-  canonical_commands:
-    - "intake repo <path>"
-    - "checkpoint change <path>"
-    - "verify maintenance <path>"
-    - "verify substantial <path>"
-    - "verify release <path>"
-    - "close planned <path>"
-    - "close urgent <path>"
-    - "recover repo <path>"
-    - "handover full <path>"
-    - "handover split <path>"
-    - "handover model <path>"
-    - "handover human <path>"
-
-signals:
-  - name: "session.intake"
-    command: "intake repo <path>"
-  - name: "session.checkpoint"
-    command: "checkpoint change <path>"
-  - name: "session.verify.maintenance"
-    command: "verify maintenance <path>"
-  - name: "session.verify.substantial"
-    command: "verify substantial <path>"
-  - name: "session.verify.release"
-    command: "verify release <path>"
-  - name: "session.close.planned"
-    command: "close planned <path>"
-  - name: "session.close.urgent"
-    command: "close urgent <path>"
-  - name: "session.recover"
-    command: "recover repo <path>"
-  - name: "session.handover.full"
-    command: "handover full <path>"
-  - name: "session.handover.split"
-    command: "handover split <path>"
-  - name: "session.handover.model"
-    command: "handover model <path>"
-  - name: "session.handover.human"
-    command: "handover human <path>"
diff --git a/coordination.k9.ncl b/coordination.k9.ncl
new file mode 100644
index 0000000..69721f8
--- /dev/null
+++ b/coordination.k9.ncl
@@ -0,0 +1,50 @@
+K9!
+# SPDX-License-Identifier: MPL-2.0
+# Thin coordination bindings for central session-management standards
+
+{
+  pedigree = {
+    schema_version = "1.0.0",
+    component_type = "session:coordination-binding",
+    metadata = {
+      name = "session-coordination",
+      version = "0.1.0",
+    },
+    security = {
+      leash = 'Kennel,
+    },
+  },
+
+  session_management = {
+    source_of_truth = "standards/3-practice/session-management-standards",
+    canonical_commands = [
+      "intake repo <path>",
+      "checkpoint change <path>",
+      "verify maintenance <path>",
+      "verify substantial <path>",
+      "verify release <path>",
+      "close planned <path>",
+      "close urgent <path>",
+      "recover repo <path>",
+      "handover full <path>",
+      "handover split <path>",
+      "handover model <path>",
+      "handover human <path>",
+    ],
+  },
+
+  signals = [
+    { name = "session.intake", command = "intake repo <path>" },
+    { name = "session.checkpoint", command = "checkpoint change <path>" },
+    { name = "session.verify.maintenance", command = "verify maintenance <path>" },
+    { name = "session.verify.substantial", command = "verify substantial <path>" },
+    { name = "session.verify.release", command = "verify release <path>" },
+    { name = "session.close.planned", command = "close planned <path>" },
+    { name = "session.close.urgent", command = "close urgent <path>" },
+    { name = "session.recover", command = "recover repo <path>" },
+    { name = "session.handover.full", command = "handover full <path>" },
+    { name = "session.handover.split", command = "handover split <path>" },
+    { name = "session.handover.model", command = "handover model <path>" },
+    { name = "session.handover.human", command = "handover human <path>" },
+  ],
+}
diff --git a/docs/RSR_OUTLINE.adoc b/docs/RSR_OUTLINE.adoc
index 6fb45a1..110ca34 100644
--- a/docs/RSR_OUTLINE.adoc
+++ b/docs/RSR_OUTLINE.adoc
@@ -217,7 +217,7 @@ project/
 * `Justfile`
 * `README.adoc`
 * `LICENSE` (MPL-2.0)
-* `.machine_readable/6a2/STATE.a2ml`
+* `.machine_readable/descriptiles/STATE.a2ml`
 * `.well-known/security.txt`
 * `.well-known/ai.txt`
 * `.well-known/humans.txt`
diff --git a/docs/STATE-VISUALIZER.adoc b/docs/STATE-VISUALIZER.adoc
index c30fda4..bcca0da 100644
--- a/docs/STATE-VISUALIZER.adoc
+++ b/docs/STATE-VISUALIZER.adoc
@@ -40,7 +40,7 @@
                         │  │  │ OCI      │ │ cerro-torre    │  │  │
                         │  │  │ Build    │ │ svalinn/vordr  │  │  │
                         │  │  └──────────┘ └───────────────┘  │  │
-                        │  │  ct-build.sh  deploy.k9.ncl      │  │
+                        │  │  ct-build.sh  deploy.k9.ncl.in   │  │
                         │  └──────────────────────────────────┘  │
                         └────────│─────────────────│──────────────┘
                                  │                 │
diff --git a/docs/governance/CRG-AUDIT-TEMPLATE.adoc b/docs/governance/CRG-AUDIT-TEMPLATE.adoc
index 8b8fb55..5f5f371 100644
--- a/docs/governance/CRG-AUDIT-TEMPLATE.adoc
+++ b/docs/governance/CRG-AUDIT-TEMPLATE.adoc
@@ -24,7 +24,7 @@ Evaluates the `{{REPO}}` repository against
 - Standard: `standards/component-readiness-grades/COMPONENT-READINESS-GRADES.md`
 - Template (criteria boilerplate): `rsr-template-repo/docs/governance/CRG-CRITERIA.adoc`
 - Self-declared grade (prior art):
-  * `.machine_readable/6a2/STATE.a2ml` → `grade = "<declared>"`
+  * `.machine_readable/descriptiles/STATE.a2ml` → `grade = "<declared>"`
   * `docs/READINESS.md` (if present) → per-component grades
   * Third-party badges (Glama, OpenSSF, etc.) if any — note date and scope
 - Audit date: {{CURRENT_DATE}}
@@ -64,7 +64,7 @@ Do *not* mark PRESENT without citing the path.
 | PRESENT / PARTIAL (count) / ABSENT
 | `.github/workflows/`
 
-| `.machine_readable/6a2/` canonical A2ML
+| `.machine_readable/descriptiles/` canonical A2ML
 | PRESENT (STATE, META, ECOSYSTEM, AGENTIC, NEUROSYM, PLAYBOOK) / ABSENT
 | Layout matches CLAUDE.md invariant
 
@@ -143,7 +143,7 @@ RSR compliance verdict: *met* / *partial* / *not met* — Grade D floor satisfie
 Cite *from authoritative source* (STATE.a2ml or CI log). Do not re-count by
 filesystem grep — grade the evidence that already exists.
 
-- `total-tests = N` (from `.machine_readable/6a2/STATE.a2ml` or CI).
+- `total-tests = N` (from `.machine_readable/descriptiles/STATE.a2ml` or CI).
 - Breakdown by suite: list each named suite and its count.
 - CI: `.github/workflows/<test-workflow>.yml` runs on push / tag / schedule.
 - Last green run: date + commit SHA.
@@ -280,7 +280,7 @@ them. Examples:
 == Related Files
 
 - `docs/READINESS.md` — per-component table. Note v1.0-vs-v2.0 schema alignment.
-- `.machine_readable/6a2/STATE.a2ml` — authoritative self-declared state.
+- `.machine_readable/descriptiles/STATE.a2ml` — authoritative self-declared state.
 - `docs/governance/CRG-LIFT-PLAN-{{CURRENT_DATE}}.adoc` — companion plan for
   D→C (and medium-term C→B) lifts.
 - `docs/governance/CRG-CRITERIA.adoc` — boilerplate criteria doc.
diff --git a/docs/practice/AI-CONVENTIONS.adoc b/docs/practice/AI-CONVENTIONS.adoc
index 19e30f0..a27ea6e 100644
--- a/docs/practice/AI-CONVENTIONS.adoc
+++ b/docs/practice/AI-CONVENTIONS.adoc
@@ -12,12 +12,12 @@ Per-tool config files (.cursorrules, .clinerules, etc.) reference this document.
 ## Session Startup
 
 1. Read `0-AI-MANIFEST.a2ml` FIRST (mandatory gatekeeper).
-2. Read `.machine_readable/6a2/STATE.a2ml` for current status and blockers.
-3. Read `.machine_readable/6a2/anchors/ANCHOR.a2ml` for canonical authority boundaries.
+2. Read `.machine_readable/descriptiles/STATE.a2ml` for current status and blockers.
+3. Read `.machine_readable/descriptiles/anchors/ANCHOR.a2ml` for canonical authority boundaries.
 4. Read `.machine_readable/policies/MAINTENANCE-AXES.a2ml` for maintenance/audit sequencing.
 5. Read `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` for baseline controls.
 6. Read `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` for execution order.
-7. Read `.machine_readable/6a2/AGENTIC.a2ml` for agent constraints.
+7. Read `.machine_readable/descriptiles/AGENTIC.a2ml` for agent constraints.
 
 ## License
 
@@ -79,9 +79,9 @@ Use `just` (Justfile) for all build, test, lint, and format tasks.
 ## References
 
 - `0-AI-MANIFEST.a2ml` -- universal AI entry point
-- `.machine_readable/6a2/AGENTIC.a2ml` -- agent permissions and constraints
-- `.machine_readable/6a2/STATE.a2ml` -- current project state
-- `.machine_readable/6a2/anchors/ANCHOR.a2ml` -- canonical authority and policy boundary
+- `.machine_readable/descriptiles/AGENTIC.a2ml` -- agent permissions and constraints
+- `.machine_readable/descriptiles/STATE.a2ml` -- current project state
+- `.machine_readable/descriptiles/anchors/ANCHOR.a2ml` -- canonical authority and policy boundary
 - `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -- canonical axis sequencing and audit requirements
 - `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -- baseline maintenance checklist policy
 - `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -- axis execution approach policy
diff --git a/docs/status/READINESS.adoc b/docs/status/READINESS.adoc
index c692a07..a1fdbd9 100644
--- a/docs/status/READINESS.adoc
+++ b/docs/status/READINESS.adoc
@@ -40,7 +40,7 @@ evidence doesn't support the claim.
 *Evidence gates (v2.0 is stricter than v1.0):*
 
 * *D*: RSR-compliant + per-capability tests + documented scope. Test matrix
-  must cite counts and live in `.machine_readable/6a2/STATE.a2ml` or CI.
+  must cite counts and live in `.machine_readable/descriptiles/STATE.a2ml` or CI.
 * *C*: All of D, plus active dogfooding in home context with *no known
   home-context failures over an evidence window*, plus *deep per-file and
   per-directory annotation* (purpose, boundaries, invariants,
@@ -185,7 +185,7 @@ Real-world external feedback confirming value. Populate
 * `docs/governance/CRG-AUDIT-<DATE>.adoc` — formal audit (populate from
   `rsr-template-repo/docs/governance/CRG-AUDIT-TEMPLATE.adoc`).
 * `docs/practice/DOGFOOD-LOG.adoc` — dated dogfood evidence (required for C).
-* `.machine_readable/6a2/STATE.a2ml` — authoritative state (canonical keys
+* `.machine_readable/descriptiles/STATE.a2ml` — authoritative state (canonical keys
   `[dogfooding-status]`, `[external-targets]`, `[issues-fed-back]`,
   `[field-signal]`).
 
diff --git a/docs/status/ROADMAP.adoc b/docs/status/ROADMAP.adoc
index 805b8e9..c6f3547 100644
--- a/docs/status/ROADMAP.adoc
+++ b/docs/status/ROADMAP.adoc
@@ -3,7 +3,7 @@
 = systemet Roadmap
 
 Milestones mirror the `route-to-mvp` phases in
-`.machine_readable/6a2/STATE.a2ml` (the single source for phase percentages)
+`.machine_readable/descriptiles/STATE.a2ml` (the single source for phase percentages)
 and the obligation ledger `docs/theory/OBLIGATIONS.adoc` (ET-1..ET-15).
 
 == Current status
@@ -42,8 +42,9 @@ Honest completion figure lives in STATE.a2ml, evidence in
 
 == Estate-alignment items
 
-* Pending decision: migrate `.machine_readable/6a2/` to the descriptiles
-  layout (deferred — see the tracking issue; contractiles.mjs needs a Node
+* The descriptiles are in `.machine_readable/descriptiles/` (moved from the former
+  `6a2` directory by pure renames). Pending decision: validate them against the
+  contractiles (deferred — see the tracking issue; contractiles.mjs needs a Node
   exception this repo has not taken).
 * Downstream: anytype must pin systemet (EXPLAINME §Relationship); audit
   findings tracked as `[ET-*]` issues on hyperpolymath/anytype.
diff --git a/machine-readable-design/canonical-directory-structure/README.adoc b/machine-readable-design/canonical-directory-structure/README.adoc
index 8ced07d..62bfc50 100644
--- a/machine-readable-design/canonical-directory-structure/README.adoc
+++ b/machine-readable-design/canonical-directory-structure/README.adoc
@@ -11,7 +11,7 @@ and customize them with your project-specific content.
 [tree]
 ----
 .machine_readable/
-├── 6a2/
+├── descriptiles/
 │   ├── anchors/
 │   ├── META.a2ml
 │   ├── ECOSYSTEM.a2ml
@@ -48,7 +48,7 @@ The following command-line runners process these files:
 | `adjust` | Adjustfile.a2ml | Drift tolerance + corrective actions
 | `bust` | Bustfile.a2ml | Rollback procedures
 | `dust` | Dustfile.a2ml | Cleanup/hygiene checks
-| `anchor` | anchors/ | Anchoring system (6a2)
+| `anchor` | anchors/ | Anchoring system (descriptiles)
 | `just` | Justfile | Task automation
 |===
 
diff --git a/scripts/validate-template.sh b/scripts/validate-template.sh
index 97ba0f2..1162036 100755
--- a/scripts/validate-template.sh
+++ b/scripts/validate-template.sh
@@ -127,10 +127,10 @@ echo ""
 log_info "Phase 2: Machine-readable metadata (.machine_readable/)"
 echo ""
 
-check_file_exists ".machine_readable/6a2/STATE.a2ml" "Project state"
-check_file_exists ".machine_readable/6a2/META.a2ml" "Architecture decisions"
-check_file_exists ".machine_readable/6a2/ECOSYSTEM.a2ml" "Ecosystem position"
-check_file_exists ".machine_readable/6a2/anchors/ANCHOR.a2ml" "Semantic boundary anchor"
+check_file_exists ".machine_readable/descriptiles/STATE.a2ml" "Project state"
+check_file_exists ".machine_readable/descriptiles/META.a2ml" "Architecture decisions"
+check_file_exists ".machine_readable/descriptiles/ECOSYSTEM.a2ml" "Ecosystem position"
+check_file_exists ".machine_readable/descriptiles/anchors/ANCHOR.a2ml" "Semantic boundary anchor"
 check_file_exists ".machine_readable/policies/MAINTENANCE-AXES.a2ml" "Maintenance axes"
 
 #==============================================================================
@@ -219,7 +219,7 @@ if [ "$(basename "$REPO_ROOT")" = "rsr-template-repo" ]; then
     log_pass "Skipping placeholder check for template repo"
 else
     # Check that key files don't have unresolved placeholders
-    for file in "$REPO_ROOT/README.adoc" "$REPO_ROOT/Justfile" "$REPO_ROOT/.machine_readable/6a2/STATE.a2ml"; do
+    for file in "$REPO_ROOT/README.adoc" "$REPO_ROOT/Justfile" "$REPO_ROOT/.machine_readable/descriptiles/STATE.a2ml"; do
         if [ -f "$file" ]; then
             if has_placeholder "$file"; then
                 log_warning "File contains unresolved placeholders: $(basename "$file")"
diff --git a/session/README.adoc b/session/README.adoc
index d14a6d7..a6b1de7 100644
--- a/session/README.adoc
+++ b/session/README.adoc
@@ -11,7 +11,7 @@ Authoritative protocols live in:
 This repo keeps only thin bindings:
 
 * `+dispatch.sh+` maps canonical commands to central protocol paths.
-* `+custom-checks.k9+` defines repo-local policy checks.
+* `+custom-checks.k9.ncl+` defines repo-local policy checks as a Nickel record.
 * `+local-hooks.sh+` provides optional repo-specific hook behavior.
 
 === Canonical Commands
diff --git a/session/custom-checks.k9 b/session/custom-checks.k9
deleted file mode 100644
index bd932fa..0000000
--- a/session/custom-checks.k9
+++ /dev/null
@@ -1,15 +0,0 @@
-# Local repository session checks (thin policy layer)
-version: "0.1"
-
-checks:
-  - id: "session-state-has-next-action"
-    applies_to: ["close planned", "close urgent", "handover full", "handover split", "handover model", "handover human"]
-    requirement: "LAST-CANONICAL-COMMAND.md contains next intended action"
-
-  - id: "session-state-has-residual-risks"
-    applies_to: ["verify maintenance", "verify substantial", "verify release", "recover repo"]
-    requirement: "Residual risks field is not left blank"
-
-  - id: "session-state-has-recommended-next-protocol"
-    applies_to: ["intake repo", "checkpoint change", "recover repo", "handover full"]
-    requirement: "Recommended next protocol is set"
diff --git a/session/custom-checks.k9.ncl b/session/custom-checks.k9.ncl
new file mode 100644
index 0000000..7f6c01a
--- /dev/null
+++ b/session/custom-checks.k9.ncl
@@ -0,0 +1,52 @@
+K9!
+# SPDX-License-Identifier: MPL-2.0
+# Local repository session checks (thin policy layer)
+
+{
+  pedigree = {
+    schema_version = "1.0.0",
+    component_type = "session:custom-checks",
+    metadata = {
+      name = "custom-session-checks",
+      version = "0.1.0",
+    },
+    security = {
+      leash = 'Kennel,
+    },
+  },
+
+  checks = [
+    {
+      id = "session-state-has-next-action",
+      applies_to = [
+        "close planned",
+        "close urgent",
+        "handover full",
+        "handover split",
+        "handover model",
+        "handover human",
+      ],
+      requirement = "LAST-CANONICAL-COMMAND.md contains next intended action",
+    },
+    {
+      id = "session-state-has-residual-risks",
+      applies_to = [
+        "verify maintenance",
+        "verify substantial",
+        "verify release",
+        "recover repo",
+      ],
+      requirement = "Residual risks field is not left blank",
+    },
+    {
+      id = "session-state-has-recommended-next-protocol",
+      applies_to = [
+        "intake repo",
+        "checkpoint change",
+        "recover repo",
+        "handover full",
+      ],
+      requirement = "Recommended next protocol is set",
+    },
+  ],
+}
diff --git a/tests/e2e/template_instantiation_test.sh b/tests/e2e/template_instantiation_test.sh
index bd5fcb3..8d11346 100755
--- a/tests/e2e/template_instantiation_test.sh
+++ b/tests/e2e/template_instantiation_test.sh
@@ -236,8 +236,8 @@ done
 log_step "Verifying machine-readable metadata"
 
 METADATA_FILES=(
-    ".machine_readable/6a2/STATE.a2ml"
-    ".machine_readable/6a2/META.a2ml"
+    ".machine_readable/descriptiles/STATE.a2ml"
+    ".machine_readable/descriptiles/META.a2ml"
 )
 
 for file in "${METADATA_FILES[@]}"; do