docs: Step 1 navigation and link polish

README.md

@@ -1,6 +1,6 @@
 # SNodeC control repository
 
-This repository owns the organization catalog and the [profile](profile/README.md) generated from it. Brand tokens define the shared accents, contrast pairs and glyphs. The shared Verify workflow provides reusable, manifest-driven verification. The navigation plan, page-header generator keep documentation paths, generated navigation and tracked-page reachability reviewable from one control point.
+This repository owns the organization catalog and the [profile](profile/README.md) generated from it. Brand tokens define the shared accents, contrast pairs and glyphs. The shared Verify workflow provides reusable, manifest-driven verification. The navigation plan, page-header generator and optional `docs-audit` command keep documentation paths, generated navigation and tracked-page reachability reviewable from one control point.
 
 ## Documentation
 
@@ -106,11 +106,11 @@ Whitespace checks run against the PR base or previous push commit (empty tree
 on the initial commit). An independent job also checks changed C/C++ and CMake
 files against existing repository formatting policies. Documentation and presentation assets are not verification gates. It neither invents a style where none exists nor performs unreliable external-URL probes. Failures are collected rather than stopping at the first file. This job still runs when compilation/tests fail.
 
-### Verify releases and caller pins
+### Shared Verify updates
 
-A changed `verify.yml` ships at a new `vX.Y` tag after review and merge. Existing tags are never moved. The current release is `v1.3`, commit `465c7e9398b1c1ab294967153bf855af52b84082`. Callers pin the full release commit SHA with a `# vX.Y` comment; they pass no secrets unless Verify actually reads one (currently none). Product CI remains `workflow_dispatch`-only by owner decision, independent of the existing version-tag package pipelines.
+The five product callers and `templates/ci.yml` use `verify.yml@main`, following the API-verified default branch of this control repository. A merged shared-workflow change is used by their next manually started CI runs; it does not start those runs. Callers pass no secrets unless Verify actually reads one (currently none). Product CI remains `workflow_dispatch`-only, independent of version-tag package pipelines.
 
-Every Verify release updates `templates/ci.yml` and all callers to the new tag's full commit SHA in the same release step, once the new tag exists. The template is the canonical onboarding example, not a mutable-tag shortcut. The documented release step keeps the template current without a network-dependent newest-tag test.
+Existing tags are historical snapshots and are never moved. Page-header, menu and profile generation are separate from build CI; documentation changes require neither a Verify release nor caller updates. `docs-audit` is optional local/PR review tooling and is never a build, signing or publication gate.
 
 Tests execute the actual inline workflow scripts, including ordered source
 builds and a real CMake/CTest/staged-install consumer, Python commands and
@@ -121,4 +121,4 @@ Repository README frames and generated navigation are governed by the [navigatio
 
 Historical rollout and design records live only in [history](history/README.md); they are not current release policy. See also [brand values](brand/README.md), [contributing](CONTRIBUTING.md) and [security](SECURITY.md).
 
-Verify `v1.3` removes documentation enforcement. The canonical template and existing callers pin its full commit SHA. Existing `v1.0`, `v1.1` and `v1.2` tags remain unchanged.
+Verify no longer enforces documentation. Existing `v1.0`–`v1.3` tags remain unchanged.

navigation/README.md

@@ -7,11 +7,23 @@ python tools/snodec_sync page-headers --repo /path/to/checkout
 python tools/snodec_sync page-headers --repo /path/to/checkout --check
 ```
 
-Apply the plan's `git mv` and declared deletions before generating. `page-headers` does not move/delete authored pages or rewrite unrelated links. It fails if required moved pages are absent or declared deletions remain; `--check` reports drift without writing. For DistributionPackages publication sources, select `site/` to use the Packages plan; the DistributionPackages root uses its own plan. Missing generated status files are supplied by the publisher. The generator installs packages, reads secrets, calls the network or publishes anything.
+Apply the plan's `git mv` and declared deletions before generating. `page-headers` does not move/delete authored pages or rewrite unrelated links. It fails if required moved pages are absent or declared deletions remain; `--check` reports drift without writing. For DistributionPackages publication sources, select `site/` to use the Packages plan; the DistributionPackages root uses its own plan. Missing generated status files are supplied by the publisher. The generator does not install packages, read secrets, call the network or publish anything.
 
 ## Documentation ownership
 
-Documentation edits are not CI reachability, link, anchor or generated-output gates. The former docs-audit command, its exemptions and its tests have been removed. Use the page-header generator when updating shared navigation; it is not a prerequisite for code verification.
+Documentation review is separate from build verification. `docs-audit` is an optional, read-only local/PR review command; it never runs in Verify, package builds or publication. A new planned Markdown page is added to `plan.yml` in the same PR. Existing excluded media notes remain reachable but have no generated header. Narrow `exempt:` declarations identify published-output targets or vendored/generated fixture paths with a reason; they do not excuse ordinary unreachable pages.
+
+```sh
+python tools/snodec_sync docs-audit --repo /path/to/checkout
+```
+
+The audit reports unplanned enrolled pages, unreachable tracked Markdown, broken local links, missing anchors and generated blocks. It also reports image buttons outside marked navigation blocks, missing parent backlinks and files above 300 KB; files above 100 KB are information only. It does not fetch remote URLs. `section_list: false` disables the generated section list where an existing project table is the section's navigation authority.
+
+## Design rules
+
+Button images are allowed only in the banner navigation row (or the root Organization block) and the marked title menu, including the organization area menu. Everything below that menu is a normal text link, including route choices. Wrap title menus in `<!-- snodec:begin menu -->` / `<!-- snodec:end menu -->`.
+
+Tables grow by rows: one thing per row. A growing project set gets another row or another page, never another project column or a list of projects within a cell.
 
 ## Shared rendering
 
@@ -22,10 +34,10 @@ header = render_header('Packages', 'status/snodec.md')
 
 The read-only library accepts a catalog name or checkout path. Future PROJECTS-driven status pages inherit their declared section/sibling Up policy; they need no additional project registry. Other undeclared presentation pages fail. Runtime uses Python's standard library and PyYAML only. The checked-in marks and Octicons are inputs, not runtime downloads.
 
-The generator replaces marked headers, preserves historic anchors outside the block and generates section lists from actual H1s in plan order. Root READMEs and the profile get no page headers. Banner plus button row stays unchanged: ↑ parent on the left; Organization first in HTML, then Repository, both right-aligned. The Organization button is labelled Organization. Buttons stay 160 px wide. The existing wider native/OpenWrt route buttons and native wrapping remain unchanged. Structural menus are arrow-free; onward/up-menu arrows retain their approved geometry.
+The generator replaces marked headers, preserves historic anchors outside the block and generates section lists from actual H1s in plan order. Root READMEs and the profile get no page headers. Banner plus button row stays unchanged: ↑ parent on the left; Organization first in HTML, then Repository, both right-aligned. The Organization button is labelled Organization. Buttons stay 160 px wide. Native wrapping remains unchanged. Structural title menus are arrow-free; onward and route links are ordinary text.
 
 Desktop banners remain 1280×56. At viewport widths up to 640 px, `<picture>` selects the existing 480×72 compact SVG, with the same mark, palette and typography. Phone stacking of Organization above Repository is accepted. No CSS workaround or alternate renderer is introduced. DistributionPackages reuses the authoritative Packages gear and infrastructure accent instead of duplicating its graphic.
 
 ## Tests and releases
 
-Run `python -m unittest discover -s tests -v` for generator and workflow behavior. Presentation goldens and authored-document drift gates are not maintained. Existing release tags remain unchanged; a changed Verify workflow requires a new approved release and caller pins.
+Run `python -m unittest discover -s tests -v` for generator and workflow behavior. Presentation goldens and authored-document drift gates are not maintained. Existing release tags remain unchanged. Verify callers and the template follow `@main` by owner decision; documentation tooling does not require a Verify release.

navigation/plan.yml

@@ -139,8 +139,8 @@ snode.c:
     kind: code
     title: Express Compatibility Suite (Node.js/Express v4 vs SNode.C/Express)
     label: Tests
-    up: README.md
-    up_label: SNode.C
+    up: src/apps/README.md
+    up_label: Examples
   - old: src/tools/snodec-control/README.md
     new: src/tools/snodec-control/README.md
     kind: code
@@ -167,8 +167,8 @@ snode.c:
     kind: code
     title: Legacy Stream Component Test Coverage
     label: Tests
-    up: README.md
-    up_label: SNode.C
+    up: docs/guides/README.md
+    up_label: Guides
 mqttsuite:
   display: MQTTSuite
   source: mqttsuite
@@ -881,6 +881,7 @@ Packages:
   - old: status/README.md
     new: status/README.md
     kind: doc
+    section_list: false
     title: (generated)
     label: Package status
     up: README.md
@@ -915,22 +916,33 @@ Packages:
     remove: true
 # Visible-label shortening required by the approved 160px menu rule.
 # Destinations, tooltips and alternative text remain unchanged.
-menu_labels:
-  Native client & server: Client/server
-  SSE & WebSocket: SSE/WebSocket
-  Subprotocol source: Subprotocol
-  Signed packages: Packages
-  Build from source: From source
-  Mapping examples: Examples
-  Mapping schema: Map schema
-  MQTTStore guide: Store guide
-  Projection schema: Projection
-  Grouping & lifecycle: Groups/lifecycle
-  Browser frontend: Browser
-  Selected packages: Selected
+menu_labels: {}
 
 DistributionPackages:
   display: DistributionPackages
+  exempt:
+  - path: site/install/install.sh
+    reason: Resolves in published Packages.
+  - path: site/status/**
+    reason: Resolves in published Packages.
+  - path: site/keys/*.asc
+    reason: Resolves in published Packages.
+  - path: site/keys/*.pub
+    reason: Resolves in published Packages.
+  - path: site/keys/*.pem
+    reason: Resolves in published Packages.
+  - path: site/openwrt/**
+    reason: Resolves in published Packages.
+  - path: site/raspberrypios/**
+    reason: Resolves in published Packages.
+  - path: site/debian/**
+    reason: Resolves in published Packages.
+  - path: site/ubuntu/**
+    reason: Resolves in published Packages.
+  - path: site/rocky/**
+    reason: Resolves in published Packages.
+  - path: site/fedora/**
+    reason: Resolves in published Packages.
   source: DistributionPackages
   sections:
     docs: Documentation
@@ -943,7 +955,7 @@ DistributionPackages:
     intro: Setup and maintenance of package publication.
     label: Documentation
     up: README.md
-    up_label: Distribution
+    up_label: Dist. Packages
   - old: docs/maintainers.md
     new: docs/maintainers.md
     kind: doc

profile/README.md

@@ -12,14 +12,16 @@ An ecosystem for building event-driven networked programs in C++ and running MQT
 - **Learn:** [Book companion](https://github.com/SNodeC/SNode.C-Book-Companion) and [examples](#learn)
 - **Install signed packages:** [Packages](https://github.com/SNodeC/Packages) · snode.c · mqttsuite
 
+<!-- snodec:begin menu -->
 <p>
-<a href="#framework" title="Framework"><img src="media/menu/framework-108.svg" alt="Framework" width="160" height="28"></a>
-<a href="#suites" title="Suites"><img src="media/menu/suites-108.svg" alt="Suites" width="160" height="28"></a>
-<a href="#applications" title="Applications"><img src="media/menu/applications-108.svg" alt="Applications" width="160" height="28"></a>
-<a href="#learn" title="Learn"><img src="media/menu/learn-108.svg" alt="Learn" width="160" height="28"></a>
-<a href="#community-projects" title="Community projects"><img src="media/menu/community-108.svg" alt="Community projects" width="160" height="28"></a>
-<a href="#distribution--infrastructure" title="Distribution &amp; infrastructure"><img src="media/menu/infrastructure-108.svg" alt="Distribution &amp; infrastructure" width="160" height="28"></a>
+<a href="#framework" title="Framework"><img src="media/menu/framework.svg" alt="Framework" width="160" height="28"></a>
+<a href="#suites" title="Suites"><img src="media/menu/suites.svg" alt="Suites" width="160" height="28"></a>
+<a href="#applications" title="Applications"><img src="media/menu/applications.svg" alt="Applications" width="160" height="28"></a>
+<a href="#learn" title="Learn"><img src="media/menu/learn.svg" alt="Learn" width="160" height="28"></a>
+<a href="#community-projects" title="Community projects"><img src="media/menu/community.svg" alt="Community projects" width="160" height="28"></a>
+<a href="#distribution--infrastructure" title="Distribution &amp; infrastructure"><img src="media/menu/infrastructure.svg" alt="Distribution &amp; infrastructure" width="160" height="28"></a>
 </p>
+<!-- snodec:end menu -->
 
 ## Framework
 

templates/ci.yml

@@ -3,4 +3,4 @@ on: [workflow_dispatch]
 permissions: { contents: read }
 jobs:
   snodec:
-    uses: SNodeC/.github/.github/workflows/verify.yml@465c7e9398b1c1ab294967153bf855af52b84082 # v1.3
+    uses: SNodeC/.github/.github/workflows/verify.yml@main

templates/readme-frame.md

@@ -64,3 +64,7 @@ Supporting pages enrolled in `navigation/plan.yml` use the generated `page-heade
 Docs indexes retain the common menu as route maps. Individual L2 guides use the generated page header for return navigation and only relevant local navigation, not another complete README menu or a self-linking Build button. Standard menu targets are available on preview branches; preserve meaningful existing anchors when they still name substantive sections. Do not fabricate compatibility or platform support from version numbers alone.
 
 The generated Repository, Organization and ↑ parent buttons provide return navigation; do not add duplicate Back blocks. User guides and implementation/qualification records occupy separately labelled groups in docs indexes; historical records do not define current product behavior.
+
+## Navigation and tables
+
+Button images belong only in the marked banner navigation / root Organization block and the marked title menu. Below the menu, use ordinary text links, including install routes and further reading. Tables grow by rows: one thing per row; add a project row or a page rather than widening a cell with a growing project list.