chore: organize relay docs and deployment artifacts

.github/workflows/ci.yml

@@ -157,12 +157,12 @@ jobs:
         with:
           python-version: ${{ matrix.python }}
       - run: python -m pip install '.[relay,mcp]' build
-      - run: python -m unittest tests.test_native_relay tests.test_relay69 tests.test_relay_lifecycle tests.test_relay_auth tests.test_relay_control -v
+      - run: python -m unittest tests.test_native_relay tests.test_relay_protocol tests.test_relay_lifecycle tests.test_relay_auth tests.test_relay_control -v
       - run: python -m build
       - name: Verify optional transport packaging
         run: |
           python -c 'import glob,zipfile; z=zipfile.ZipFile(glob.glob("dist/*.whl")[0]); assert "session_peer_relay/cli.py" in z.namelist(); assert not any(n.startswith("experiments/") for n in z.namelist())'
-          python -c 'import glob,tarfile; t=tarfile.open(glob.glob("dist/*.tar.gz")[0]); assert not any("/experiments/" in n for n in t.getnames())'
+          python -c 'import glob,tarfile; t=tarfile.open(glob.glob("dist/*.tar.gz")[0]); n=t.getnames(); assert not any("/experiments/" in p for p in n); assert any(p.endswith("/docs/README.md") for p in n); assert any(p.endswith("/deploy/examples/static-account/session-peer-relay.service") for p in n); assert any(p.endswith("/deploy/examples/authenticated-control/session-peer-control.service") for p in n); assert not any("/deploy/ops/" in p for p in n)'
       - name: Optional management CLI smoke
         run: |
           session-peer device --help

README.ja.md

@@ -95,6 +95,7 @@ npx -y skills@latest add abruption/session-peer-skill \
 ## ドキュメント
 
 - [プロジェクトガイドサイト](https://abruption.dev/projects/session-peer/): 概要、クイックスタート、ドキュメントへの入口
+- [リポジトリ文書マップ](https://github.com/abruption/session-peer/blob/main/docs/ja/README.md): ユーザー、統合、運用、開発、履歴資料
 - [CLIリファレンス](https://github.com/abruption/session-peer/blob/main/docs/ja/cli-reference.md): コマンド、JSON、環境変数、更新、制約、検証履歴
 - [診断と返信](https://github.com/abruption/session-peer/blob/main/docs/ja/diagnostics.md) · [複数のCodexホーム](https://github.com/abruption/session-peer/blob/main/docs/ja/multi-home-list.md)
 - [cc-peerからの移行](https://github.com/abruption/session-peer/blob/main/docs/ja/cli-reference.md#moving-from-cc-peer) · [リリース](https://github.com/abruption/session-peer/releases)

README.ko.md

@@ -95,6 +95,7 @@ npx -y skills@latest add abruption/session-peer-skill \
 ## 문서
 
 - [프로젝트 안내 사이트](https://abruption.dev/projects/session-peer/): 핵심 소개, 빠른 시작과 문서 진입점
+- [저장소 문서 지도](https://github.com/abruption/session-peer/blob/main/docs/ko/README.md): 사용자, 통합, 운영, 개발, 이력 문서 분류
 - [CLI 상세](https://github.com/abruption/session-peer/blob/main/docs/ko/cli-reference.md): 명령, JSON, 환경 변수, 업데이트, 제약, 검증 이력
 - [진단·회신](https://github.com/abruption/session-peer/blob/main/docs/ko/diagnostics.md) · [여러 Codex 홈](https://github.com/abruption/session-peer/blob/main/docs/ko/multi-home-list.md)
 - [cc-peer에서 전환](https://github.com/abruption/session-peer/blob/main/docs/ko/cli-reference.md#moving-from-cc-peer) · [릴리스](https://github.com/abruption/session-peer/releases)

README.md

@@ -99,6 +99,7 @@ Install the alpha explicitly with `pipx install 'session-peer[relay]==1.0.0a1'`;
 ## Documentation
 
 - [Project site](https://abruption.dev/projects/session-peer/): a curated overview, quick start, and documentation entry point.
+- [Repository documentation map](https://github.com/abruption/session-peer/blob/main/docs/README.md): user, integration, operator, development, and historical references.
 - [CLI reference](https://github.com/abruption/session-peer/blob/main/docs/cli-reference.md): commands, JSON, environment variables, updates, limits, and validation history.
 - [Diagnostics and replies](https://github.com/abruption/session-peer/blob/main/docs/diagnostics.md) · [Multiple Codex homes](https://github.com/abruption/session-peer/blob/main/docs/multi-home-list.md)
 - [Moving from cc-peer](https://github.com/abruption/session-peer/blob/main/docs/cli-reference.md#moving-from-cc-peer) · [Releases](https://github.com/abruption/session-peer/releases)

README.zh-CN.md

@@ -93,6 +93,7 @@ npx -y skills@latest add abruption/session-peer-skill \
 ## 文档
 
 - [项目指南网站](https://abruption.dev/projects/session-peer/)：核心概览、快速开始和文档入口
+- [仓库文档导航](https://github.com/abruption/session-peer/blob/main/docs/zh-CN/README.md)：用户、集成、运维、开发和历史资料
 - [CLI参考](https://github.com/abruption/session-peer/blob/main/docs/zh-CN/cli-reference.md)：命令、JSON、环境变量、更新、限制及验证记录
 - [诊断与回复](https://github.com/abruption/session-peer/blob/main/docs/zh-CN/diagnostics.md) · [多个Codex主目录](https://github.com/abruption/session-peer/blob/main/docs/zh-CN/multi-home-list.md)
 - [从cc-peer迁移](https://github.com/abruption/session-peer/blob/main/docs/zh-CN/cli-reference.md#moving-from-cc-peer) · [发行版本](https://github.com/abruption/session-peer/releases)

deploy/README.md

@@ -0,0 +1,25 @@
+# Deployment material
+
+Deployment files are separated by purpose so an example cannot be mistaken for
+the live Abruption topology.
+
+## Reusable examples
+
+- [`examples/static-account`](examples/static-account/README.md) runs only the
+  blind relay with operator-provisioned hashed bearer accounts. It has no OAuth,
+  browser UI, control database, public-state publisher or managed revocation.
+- [`examples/authenticated-control`](examples/authenticated-control/README.md)
+  is the control-service half of a managed deployment. It requires an explicit
+  migration, provider credentials, a compatible managed relay, readiness and
+  recovery policy. It must not be combined with the static-account relay unit.
+
+These files are templates. Copying a unit is not installation or validation.
+Review paths, service identity, credentials, resource limits, network policy and
+backup scope for the target host before enabling anything.
+
+## Instance-specific operations
+
+[`ops/abruption-kr`](ops/abruption-kr/README.md) preserves secret-free copies of
+the deployed KR service contracts and recovery helper. Those files document one
+reviewed installation; their paths, users, runtime and Authelia/Caddy topology
+are not reusable defaults.

deploy/examples/authenticated-control/README.md

@@ -0,0 +1,15 @@
+# Authenticated control example
+
+This directory contains the control-service template for browser OAuth, native
+device authorization, managed enrollment and publication of relay verification
+state. It is not a complete deployment by itself.
+
+Run the compiled migration explicitly under the same service identity and writer
+lock before starting the service. Configure only enabled provider credentials,
+the canonical HTTPS origin, protected private state and a dedicated public-state
+directory. A compatible relay must consume that directory read-only, retain its
+replay/high-water state, fail closed on stale state and participate in an
+explicit readiness/recovery topology.
+
+Do not combine this unit with the static-account relay example. For a complete,
+instance-specific reference see [`../../ops/abruption-kr`](../../ops/abruption-kr/README.md).

deploy/examples/static-account/README.md

@@ -0,0 +1,12 @@
+# Static-account blind relay example
+
+This example runs `session-peer relay serve --accounts ...` with a private JSON
+file containing only hashed bearer admission values, rooms and roles. It does
+not run the browser control service and cannot provide OAuth login, managed
+device enrollment, operation receipts or immediate managed revocation.
+
+Adapt the paths and supply `accounts.json` through systemd credentials. Keep the
+listener on loopback behind a reviewed TLS reverse proxy. The service limits are
+initial safety bounds rather than a capacity guarantee. Validate the final unit
+with `systemd-analyze verify` and a loopback authentication test before enabling
+it.

docs/README.md

@@ -0,0 +1,29 @@
+# session-peer documentation
+
+English is the canonical source. Korean, Japanese and Simplified Chinese editions
+mirror the same navigation and normative behavior. Start with the shortest guide
+for your goal; protocol and validation records are review material, not parallel
+installation paths.
+
+## Users
+
+- [CLI reference](cli-reference.md) covers local and SSH discovery, sending, JSON, updates and limits.
+- [Diagnostics and replies](diagnostics.md) explains truthful submission states and safe troubleshooting.
+- [Multiple Codex homes](multi-home-list.md), [explicit wake](wake.md) and [Antigravity](antigravity.md) cover optional agent workflows.
+
+## AI-assisted setup and integrations
+
+- [AI assistant guide](ai-assistant-guide.md) is the bounded handoff for an agent performing setup or verification.
+- [MCP](mcp.md) and [agent adapters](agent-adapters.md) describe optional integrations and policy boundaries.
+
+## Paired devices and operators
+
+- [Paired devices](paired-devices.md) is the user path for direct or hosted end-to-end encrypted relay use.
+- [Relay authentication](relay-auth.md), [lifecycle and recovery](relay-lifecycle.md), [watchdog](relay-watchdog.md), and [edge policy](relay-edge-policy.md) are operator references.
+- [Deployment material](../deploy/README.md) separates reusable examples from the Abruption KR operational reference.
+
+## Development and history
+
+- [Agent transport architecture](architecture/agent-transports.md) and the [relay development plan](relay-development-plan.md) explain implementation boundaries.
+- [Release notes](releases/v1.0.0-alpha.1.md) describe published behavior; [validation records](validation/69-rc.md) preserve scoped evidence and limitations.
+- The completed relay69 prototype source was removed after its unique regressions moved to the product relay suite. Git history remains the source for obsolete prototype code.

docs/i18n-manifest.json

@@ -2,9 +2,10 @@
   "canonicalLocale": "en",
   "schemaVersion": 1,
   "sources": {
-    "README.md": "735bd8e4dca1e41e0aa00651df8adf70aace46c4733da830232aa53edefc4deb",
+    "README.md": "551ae5d5c9403185ea13305d5b71cef3ce21f8761ad3d3039d73ab2638cf8daf",
     "RELEASING.md": "cfbe28076a6126b7691aeda1172e7315ee4eb61ab80312c7e63d5d577e316184",
     "SECURITY.md": "83551e78e3525cb7e2614b303f7c6758bbddf0442bfe1b3e4529635cf2fec918",
+    "docs/README.md": "3061ee59816751d50a3589b7d8bec8dcf069c95154e484de05b258b9ab034757",
     "docs/agent-adapters.md": "bf185d3121c94829bb412071a25c4d943302e10a6b2e713111e653b8f8c3ea91",
     "docs/ai-assistant-guide.md": "9624ec96b92fb688fae3be3c94cb3564c77985091be451fbf1f056a1af9b9d9c",
     "docs/antigravity.md": "6937c0208464dc536ce810abd70e449b65cb72e1d937a3d818339f46a9ab11d4",
@@ -14,12 +15,12 @@
     "docs/download-metrics.md": "ded60e7b84d14ce779f8d639516b4e390358a06ef76b677dc9c1f997fb626a9f",
     "docs/mcp.md": "e99689b8e6a222babc9438be2b2aabee953c3e0b2f967c6582065569529c32da",
     "docs/multi-home-list.md": "f8d8e3adf727e4842ea7c4d45e8f6523b11d0513bf2509d4d1204645875e6489",
-    "docs/paired-devices.md": "ad02ac67398d22b9cd2a227d50763cc389b598431f9feb6ac86802eb30c83bce",
-    "docs/relay-auth.md": "6ef0d8017dc55c57c286eef058a40e0a6622e982d5fa0a4b0cc1775241f55be3",
+    "docs/paired-devices.md": "df6331349ba2c34a81d7dd9a4298665f18306af110086bad4bf1e1e2c1dd4a7d",
+    "docs/relay-auth.md": "b2ff176cb93ffa2a42c81111d8b152f66ec6d85e846c64ad33d62d6aa41faf8c",
     "docs/relay-development-plan.md": "f33ea62a59809ea708f679e5a0ec5fbfd7e40948c730adce3a7b214a1409cbad",
     "docs/relay-edge-policy.md": "c1c7f7a1c4303943c78ca334dab4034f66c0c272e40c007d07c3da2a496155eb",
     "docs/relay-google-bootstrap.md": "bf6ce95c1ba39a56b765542d90e49c24211de5dd7cecb453819dfc35388bed9d",
-    "docs/relay-lifecycle.md": "8a078ae197295088fb3b9c81dadb7b852c8cdea612e768db87d1fe64562295b5",
+    "docs/relay-lifecycle.md": "b9ce6d5b39548e9cdb555d81947f624941007e13e98fb8fef278ced2af666699",
     "docs/relay-public-pilot-2026-09-17.md": "e86c5528533178663f38662e15f1d7a12b6db1eab9a722e3bdbd29dd033bc1ac",
     "docs/relay-watchdog.md": "bccb789ed27e3ec5ae36343f91b2d2710d6bb3c4c8735353a07d98c8f258b5ae",
     "docs/releases/v0.6.1.md": "7fae8ab4498228d8498518c1de20de857271ae14089fe9e0bf6f7af828bd77fc",
@@ -28,11 +29,9 @@
     "docs/releases/v0.8.0.md": "317f238c008aa7679653c0cd74a8de3fb58108d3602d88e63bd5bf486744052c",
     "docs/releases/v0.9.0.md": "fa057fed64fdb1c454a25be2b28fcbeb926d4b0163cfb61b026d9409418c1052",
     "docs/releases/v1.0.0-alpha.1.md": "59004f0eb2db2dcc19a832eb260e48473ba388bf094aec38364a88db8c9d3c0b",
-    "docs/validation/69-rc.md": "7a746f0330a0b803697f4af5aa3d608c1db916e318f0ad81ac6edb9ece083906",
+    "docs/validation/69-rc.md": "4e9a2183e8ca98a6db36a7b58dfebe0f2c02b33ae6534ffcda9352ab7198337f",
     "docs/validation/85-antigravity.md": "468ba1702a60c57079730ab5b7545b0b1968f11cc6832f0ac88460664ba87723",
     "docs/wake.md": "e382df91b14f91b026280c4e12dfbdb047f2bf16e73186b959c62bb67d6b4d8c",
-    "experiments/relay69/README.md": "ca9e742cf58cf01e373d5621d078b47d052b599f0a7bbfafa94c7f4d0e7f7d38",
-    "experiments/relay69/REPORT.md": "965fd7add95112ec8327aaf5dc5bdc3654b81289b95dfb69f68d181bf7856661",
     "plugins/session-peer/README.md": "a4eeae54caac9ad824d740f7f319561f060bc9c2bbbbf7def2bdd8e36dbcd1c6"
   },
   "translatedLocales": [

docs/ja/README.md

@@ -0,0 +1,28 @@
+# session-peer ドキュメント
+
+英語版が正本です。韓国語、日本語、簡体字中国語版は同じナビゲーションと規範的な
+動作を維持します。目的に合う最短のガイドから始めてください。プロトコルと検証記録は
+レビュー資料であり、別のインストール経路ではありません。
+
+## ユーザー
+
+- [CLIリファレンス](cli-reference.md)はローカル・SSHでの検出、送信、JSON、更新、制限を説明します。
+- [診断と返信](diagnostics.md)は正確な送信状態と安全なトラブルシューティングを説明します。
+- [複数のCodexホーム](multi-home-list.md)、[明示的なwake](wake.md)、[Antigravity](antigravity.md)はオプションのエージェントワークフローを扱います。
+
+## AI支援セットアップと統合
+
+- [AIアシスタントガイド](ai-assistant-guide.md)は、エージェントにセットアップや検証を任せるための制限付き引き継ぎ文書です。
+- [MCP](mcp.md)と[エージェントアダプター](agent-adapters.md)はオプション統合とポリシー境界を説明します。
+
+## ペアデバイスと運用者
+
+- [ペアデバイス](paired-devices.md)は、直接またはホスト型のエンドツーエンド暗号化リレーを使うユーザー向け経路です。
+- [リレー認証](relay-auth.md)、[ライフサイクルと復旧](relay-lifecycle.md)、[ウォッチドッグ](relay-watchdog.md)、[エッジポリシー](relay-edge-policy.md)は運用者向け資料です。
+- [デプロイ資料](../../deploy/README.md)は再利用可能な例とAbruption KRの運用参照を分離します。
+
+## 開発と履歴
+
+- [エージェント転送アーキテクチャ](architecture/agent-transports.md)と[リレー開発計画](relay-development-plan.md)は実装境界を説明します。
+- [リリースノート](releases/v1.0.0-alpha.1.md)は公開済み動作を説明し、[検証記録](validation/69-rc.md)は範囲付きの証拠と制限を保存します。
+- 完了したrelay69プロトタイプのソースは、固有の回帰テストを製品リレースイートへ移した後に削除しました。旧プロトタイプコードはGit履歴に残ります。

docs/ja/paired-devices.md

@@ -80,7 +80,7 @@ session-peer relay serve --accounts /private/accounts.json \
   --bind 127.0.0.1 --port 3769 --seconds 3600
 ```
 
-永続的な Linux ホスティングの場合、wheel を `/opt/session-peer-relay/venv` にインストールし、ハッシュを `/etc/session-peer-relay/accounts.json` に保存して、レビュー済みの [systemd テンプレート](../../deploy/session-peer-relay.service) を適合させてください。有効化する前に `systemd-analyze verify` で検証してください。テンプレートは、動的ユーザー、ケーパビリティなし、アクセス不可のホームディレクトリ、読み取り専用システム、プライベートな一時ディレクトリ、および明示的なリソース制限で動作します。これは**ブラインドリレー**用であり、ネイティブのレシーバー用ではありません。後者はエージェントが所有するランタイムパスとソケットが必要です。
+永続的な Linux ホスティングの場合、wheel を `/opt/session-peer-relay/venv` にインストールし、ハッシュを `/etc/session-peer-relay/accounts.json` に保存して、レビュー済みの [systemd テンプレート](../../deploy/examples/static-account/session-peer-relay.service) を適合させてください。有効化する前に `systemd-analyze verify` で検証してください。テンプレートは、動的ユーザー、ケーパビリティなし、アクセス不可のホームディレクトリ、読み取り専用システム、プライベートな一時ディレクトリ、および明示的なリソース制限で動作します。これは**ブラインドリレー**用であり、ネイティブのレシーバー用ではありません。後者はエージェントが所有するランタイムパスとソケットが必要です。
 
 ループバックリレーを専用ホスト名の HTTPS/WSS リバースプロキシの背後に配置します:
 

docs/ja/relay-auth.md

@@ -328,7 +328,7 @@ iCloud の外部になければなりません。プライベート署名鍵は
 control SQLite の一貫したスナップショット、署名鍵、および OAuth ポリシーを個別の
 保護されたリソースとして含める必要があります。これは中央オントロジー SQLite では**ありません**。
 
-`deploy/session-peer-control.service` はインストールテンプレートであり、有効化された
+`deploy/examples/authenticated-control/session-peer-control.service` はインストールテンプレートであり、有効化された
 ユニットではありません: ループバック 3770、DynamicUser、排他的 flock ライターロック、プライベート永続
 状態、保護された homes/system/kernel、読み取り専用の control ツリーのみを公開する隔離された
 `/opt` マウント、アクセス不能な他サービスの data/config/log パス、ケーパビリティ