chore: merge site and docs fixes, fifth pass

wiki/testing-guide.md

@@ -42,7 +42,9 @@ tests are reported as skipped, so install them before a pull request
 full-screen tests drive `install.py --tui` on a pseudo-terminal and read the
 screen back with `pyte`, and fuzz the key decoder with `hypothesis`: both skip
 without them (`pip install pyte hypothesis`). `pip install -e ".[dev]"` from the
-checkout installs all of these at once, from the `dev` extra of `pyproject.toml`.
+checkout installs all of these at once, from the `dev` extra of `pyproject.toml`,
+which sets lower bounds only. The contributing guide's checklist reads the exact
+versions CI pins from `validate.yml`.
 No test framework beyond the standard library `unittest` module.
 
 ## Modules at a glance
@@ -377,6 +379,9 @@ to the way the project writes:
   line naming a .info, core-info or System.dat no "is correct", "is
   accurate", "still declares", "omits" or "missing". The note states what
   that file declares and what the code reads.
+- No pointer at a review in a comment, a docstring or a test name: a review
+  number in parentheses, a note file named after one, a test module or class
+  named after a review. The comment says what the code does.
 
 Formatting stays: bold labels, lists, tables and admonitions make a page
 easier to use. When markup shows raw on the site, the rendering is fixed and
@@ -460,8 +465,10 @@ A commit subject is English, 50 characters at most, `type: description` with a
 lowercase word after the colon. The types are `feat`, `refactor`, `chore`,
 `docs` and `fix`. The message does not use bug, regression, revert, dead code,
 broken, wrong, hack, workaround or implement (derived forms included), nor the
-marketing vocabulary above, and carries no Co-Authored-By trailer. A body
-explains the why when the subject cannot: the scenario that failed, the
+marketing vocabulary above, and carries no Co-Authored-By trailer. It says
+what the change does, never which review asked for it: "review 3", "audit 12"
+or "round 5" with its number points at notes no clone holds and is refused. A
+body explains the why when the subject cannot: the scenario that failed, the
 upstream `file:line` that decides it, what users will see.
 
 ```
@@ -469,6 +476,14 @@ feat: add retrobat platform support
 refactor: extract shared utils to common.py
 ```
 
+`scripts/commit_rules.py` holds these rules. Git does not copy hooks with a
+clone, so the commit-msg hook that runs them is set up once per clone:
+
+```bash
+printf '#!/bin/sh\nexec python3 scripts/commit_rules.py "$1"\n' > .git/hooks/commit-msg
+chmod +x .git/hooks/commit-msg
+```
+
 Files are staged by name, never with `git add -A` or `git add .`, which sweep in
 deletions and work that is not yours. Generated artifacts (`database.json`,
 `retired.json`, `derivable.json`, `install/*.json`, `README.md`, `CONTRIBUTING.md`, `exports/`,
@@ -512,6 +527,10 @@ of main passes, not every commit under it.
 
 Modules that need real artifacts skip themselves when those artifacts are absent,
 so `test_pack_integrity` is a no-op in CI (no `dist/`) and a real check locally.
+The exporter fidelity cases go the other way: they compare with each platform's
+own file, which `python scripts/export_native.py --all --fetch --output-dir
+tmp/native` downloads into `.cache/upstream-native/`. CI runs it before the
+suite, and a clone without that cache skips them.
 Run `python -m unittest discover -s tests -t .` before pushing.
 
 Tests must pass before merge. If a test fails in CI, reproduce locally with: