docs: reconcile documentation against the code; add a supersession ledger

Five weeks of undocumented evolution left the docs describing a site that
partly no longer exists, with nothing marking which documents were historical.
The code is treated as the source of truth throughout; every claim below was
verified against code, config or the Makefile rather than inferred.

Two mechanisms, following patterns the repo already used:

- docs/reference/superseded-decisions.md (new) — one authoritative table of all
  14 reversals: what was planned, where, what is true now, when, and why. Plus
  a short list of decisions that were NOT reversed, since their planning docs
  are old enough to look suspect.
- Inline "> **Superseded ...**" notes at each stale claim, so a claim can never
  be read un-corrected. This mirrors the existing "> History:" notes in
  architecture.md and "> **Changed 2026-07:**" in trip-switching.md.

Scope split by tense: present-tense docs (CLAUDE.md, reference/, guides/,
README.md, CONCEPTS.md) are corrected; past-tense records (plans/, specs/,
milestones/, summary.md, pm-analysis.md) are annotated only, never rewritten —
their staleness is what makes them records.

Present-tense corrections:

- CLAUDE.md asserted css-compiled/ is generated from css/style.css and
  css/tokens.css. That source relationship does not exist: css/ is hand-authored
  and served directly via assets.addCss in partials/base.html.twig, while
  css-compiled/ is esbuild output from the CSS imports inside js/src/*.js.
  Highest-severity finding — an always-loaded file inviting a hand-edit of a
  generated bundle.
- README.md documented every remote-* target without the -test/-prod suffix
  guard-env requires, so its entire server runbook was unrunnable, and listed
  7 of ~20 targets while CLAUDE.md designates it authoritative for the full
  list. Rewritten with all targets, grouped, and the suffix rule stated.
- README.md told readers to "git clone" into user/, which is a submodule.
- architecture.md: nav is Home + Trips + (authenticated) New Post, not
  "Home + Past Trips only"; template tree omitted trips.html.twig,
  post-form.html.twig and forms/, and placed base.html.twig at templates/ root
  rather than in partials/; entry-actions has three API routes, not just delete;
  added the undocumented css-compiled/maplibre-gl.css output and a section on
  the /post pin editor as the one sanctioned non-entry-map map.
- design-system.md: documented 13 colour tokens against 19 in tokens.css
  (missing --color-error, --color-draft-accent and four glass overlays); claimed
  "all 3 map templates"; and described --color-canvas as "white".
- design-system-light.md documented a light palette in present tense. No light
  mode exists — tokens.css has a single :root block, no prefers-color-scheme or
  data-theme switch, and no light hex appears in css/. Banner added.
- posting.md said photos were optional; they are required, 1-6. It documented
  hero_image, which was removed for entries (stories keep it). It had no mention
  of the frontend edit flow or photo editor, both shipped 2026-07-08. Photo
  files are photo-01..NN, zero-padded.
- working/README.md advertised summary.md as the project's "current state" while
  summary.md describes Leaflet, /tracker, /map and /stats. Most misleading line
  in the tree.
- CLAUDE.md: recorded js/src/location-map.js as the one sanctioned exception to
  the single-map-path rule, and documented that make start/setup fail on a clean
  checkout because docker-compose.yml still builds a travel-memories service
  whose source moved out in a80b0a9.

Also: 2026-07-23-post-form-location-override.md read "Not started" while merged
in user/ as dd19995; status corrected.

Findings that are not documentation problems — the compose breakage, a
repeatable drift check, the unused shortcode-gallery-plusplus, and demo fixtures
for retired views — are collected in
docs/working/2026-07-25-doc-drift-recommendations.md and deliberately not acted
on. Design and verification method: docs/working/specs/2026-07-25-docs-reconciliation-design.md

The submodule gitlink is deliberately not bumped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/reference/design-system.md

@@ -31,6 +31,13 @@
 
 ### Palette (dark theme — as implemented)
 
+**Dark is the only theme.** `css/tokens.css` has a single `:root` block; there is no
+`prefers-color-scheme` query and no `data-theme` switch. `design-system-light.md` records the
+pre-dark-mode palette, which was never implemented as a switchable theme — see
+[`superseded-decisions.md`](superseded-decisions.md) → R9.
+
+The authoritative list is `user/themes/intotheeast/css/tokens.css`.
+
 | Token | Hex | Usage |
 |---|---|---|
 | `--color-paper` | `#1A1814` | Page background — warm near-black |
@@ -46,6 +53,20 @@
 | `--color-accent-on` | `#FFFFFF` | Text on accent surfaces |
 | `--color-surface-raised` | `#2A2720` | Elevated surfaces: tooltips, hover |
 | `--color-ink-inverse` | `#17171A` | Text on accent-coloured buttons |
+| `--color-error` | `#c0392b` | Validation errors, form error status |
+| `--color-draft-accent` | `#E0A458` | Warm amber — draft/unpublished badges |
+
+#### Glass overlays
+
+Paper colour at opacity, used by the story components. Computed with `color-mix()` rather than fixed
+hex, so they track `--color-paper` automatically.
+
+| Token | Value | Usage |
+|---|---|---|
+| `--color-paper-glass-low` | `color-mix(in srgb, var(--color-paper) 8%, transparent)` | Faintest scrim |
+| `--color-paper-glass-mid` | `color-mix(in srgb, var(--color-paper) 25%, transparent)` | Standard overlay |
+| `--color-paper-glass-high` | `color-mix(in srgb, var(--color-paper) 55%, transparent)` | Heavy scrim over imagery |
+| `--color-paper-glass-hover` | `color-mix(in srgb, var(--color-paper) 80%, transparent)` | Hover state on a glass surface |
 
 ### Rationale for accent color
 
@@ -150,7 +171,7 @@ DM Serif Display has a calligraphic quality — slightly editorial, authoritativ
 - Nav links: DM Sans, `--text-sm`, weight 500, `--color-ink-2`
 - Active nav link: `--color-accent`, weight 600
 - Mobile: same layout, title slightly smaller, nav links compact
-- Background: `--color-canvas` (white), bottom border `1px solid var(--color-border)`
+- Background: `--color-canvas` (`#22201B` in the dark theme), bottom border `1px solid var(--color-border)`
 
 ### 5.2 Entry Feed Card — With Photo
 
@@ -342,7 +363,7 @@ Minimal changes — the map itself is good. Style improvements:
 | JS | Vanilla JS — unchanged | Current JS is well-structured, scope doesn't justify a framework |
 | Icons | Unicode + emoji (current) | No dependency, works everywhere |
 | Fonts | Google Fonts via CDN | Two fonts, display-swap, negligible impact |
-| Maps | MapLibre GL JS | Replaced Leaflet; all 3 map templates use it |
+| Maps | MapLibre GL JS | Replaced Leaflet. One shared display-map partial (`partials/entry-map.html.twig`), not three templates — see [`superseded-decisions.md`](superseded-decisions.md) → R12 |
 | Build | None — no build pipeline | Grav's asset pipeline handles minification if needed |
 
 **No Alpine.js, no TypeScript, no Tailwind.** The site has clean vanilla JS and CSS today; a redesign is about visual quality, not framework migration. Introducing a build pipeline on a 3-week timeline is a distraction.