docs: repoint three dead links reported by the link checker

[kyle-sexton]

The rolling link-check report listed 8 errors. Only 3 were dead links — the other 5 are live
URLs the checker cannot reach, and their fix lands upstream (see below). Every replacement here was
verified against the live target, not inferred from the URL shape.

The three dead links

docs/adr/0002-…md — GitHub retired the repositories/configuring-branches-and-merges…/managing-protected-branches/
path for the required-status-checks troubleshooting page. It now lives under
pull-requests/how-tos/merge-and-close-pull-requests/. Verified 200 with no redirect, H1 reads
"Troubleshooting required status checks", and it still covers the check-never-reports case the ADR
cites it for ("Associated checks stay in a 'Pending' state and block merging").

An independent fresh-context lookup caught that my first replacement here was itself a 301 — the
collaborating-with-pull-requests/… path redirects to the how-tos/ one. Both resolve today, but a
redirect is a second thing that can be retired, and lychee already hints to prefer resolved URLs, so
the second commit swaps in the canonical target. Verified both directions: the old path returns 301
with that Location, the new one returns 200 with none.

plugins/dometrain/README.md — Dometrain moved its plans page from /pro/ to /dometrain-pro/.
Verified 200, <title>Dometrain Plans - Dometrain</title>. The link text stays "Dometrain Pro"
because the slug and the product name both still are.

plugins/source-control/skills/babysit-prs/reference/freshness.md — the most interesting of the
three. graphql/reference/enums did not 404; it became a navigation index and no longer carries
any enum definitions at all, which is why the failure was Cannot find fragment rather than a dead
page. GitHub split the GraphQL reference by domain, so MergeStateStatus now lives on the pulls
page. The replacement was verified structurally, not just by status code: id="enum-mergestatestatus"
is present in the served HTML (so lychee's fragment check resolves it, rather than the anchor
being JS-injected), and the page carries both descriptions this doc quotes verbatim — "The head ref
is out of date" and "The merge is blocked".

The other five are not content defects, and are fixed upstream

lychee.toml is a managed component for this repo per standards/distribution/sync-manifest.yml,
so editing it here would be silently overwritten by the next sync. The config half of this report is
therefore melodic-software/standards#303:

• www.gnu.org/software/coreutils/… (429) — verified 200. A 429 is the server rate-limiting the
  checker and lands on whichever host the shared runner IP is throttled against that run, so the fix
  is accept-ing 429 rather than excluding a healthy host that would just be replaced by a
  different one next run.
• dl.acm.org and queue.acm.org (403) — 403 even with a full browser User-Agent; no header
  tuning reaches them.
• docs.genius.com (403) — 200 with a browser User-Agent; the documented bot-block case.
• www.ntia.gov (SSL not trusted) — the chain verifies locally (openssl s_client →
  Verify return code: 0 (ok), curl 200 under strict verification). A trust store failing an ECC
  chain, not an untrustworthy host.

This PR merging alone will not clear the report; #303 has to land and sync. Flagging that plainly
rather than letting a half-clear look like a regression.

Verification

Run with the real lychee.toml plus the proposed upstream config, over all seven files the report
named:

🔍 118 Total  🔗 116 Unique  ✅ 114 OK  🚫 0 Errors  👻 4 Excluded

All 8 reported errors resolved. Also run against this repo's gates:

• scripts/check-changed-skills.sh origin/main — 1 skill checked, 0 failed
• scripts/check-contract-slice-prune.sh --check-diff origin/main — pass (no docs/topics/ path is
  touched; that file's two ACM URLs are handled by exclusion, not by editing it)
• scripts/check-changelog-parity.sh --check-bump origin/main — pass. No plugin version bump: a
  corrected external URL in a reference doc changes no behavior contract, no gate requires one, and
  bumping source-control would collide with the in-flight bump on feat(source-control): evidence-gated independent-resolver mode for thread resolution #1782 — the collision class
  tracked as Plugin version bumps computed from main collide across concurrent branches #1746.
• markdownlint-cli2, typos — clean

Related

• Fixes Link checker report #640
• fix(lychee): accept 429 and exclude four checker-blocked hosts standards#303 — the upstream half; owns lychee.toml for this repo
• Plugin version bumps computed from main collide across concurrent branches #1746 — the concurrent version-bump collision class, the reason this change deliberately bumps
  nothing

🤖 Generated with Claude Code

https://claude.ai/code/session_01RhS3T7ShwJgKTrvk2Mvd3C

[claude]

Claude finished @kyle-sexton's task in 1m 26s —— View job

---

PR Review

• Read changed files
• Verify link replacements are correct
• Check alignment with CLAUDE.md guidelines
• Post review findings

---

LGTM. Three surgical one-line URL replacements, no logic or behavior changes. Notes below.

Change-by-change assessment

docs/adr/0002-…md L89
GitHub moved the required-status-checks troubleshooting page from repositories/…/managing-protected-branches/ to pull-requests/…/collaborating-on-repositories-with-code-quality-features/. The new path follows the current GitHub Docs taxonomy for PR-related content. The ADR still reads correctly — the surrounding sentence ("the ruleset flip stays LAST, after this caller restructure is verified") is purely organizational context and the linked page still covers the "pending check blocks merge" case cited there.

plugins/dometrain/README.md L10
Slug rename from /pro/ to /dometrain-pro/. Link text ("Dometrain Pro") is unchanged and still accurate. No surrounding text required updating.

plugins/source-control/skills/babysit-prs/reference/freshness.md L18
This is the only non-trivial case. The old URL (graphql/reference/enums#mergestatestatus) pointed to a navigation index that no longer carries enum definitions; the new URL (graphql/reference/pulls#enum-mergestatestatus) targets the domain-specific pulls page where MergeStateStatus now lives. The PR body notes the fragment (id="enum-mergestatestatus") is present in served HTML rather than injected by JS — meaning lychee's fragment check resolves cleanly. The document quotes two enum descriptions verbatim ("The head ref is out of date" for BEHIND, "The merge is blocked" for BLOCKED); the PR confirms both are still present at the new location.

Process/guideline checks

Check	Result
Branch naming (<type>/<description>)	fix/640-link-check-report ✓
PR body — closing keyword	Fixes #640 ✓
PR body — ## Related section	Present with #1746 and standards#303 ✓
Plugin version bump	Correctly omitted — external reference URL carries no behavioral contract; check-changelog-parity.sh confirmed pass
lychee.toml not touched	Correct — it's a managed component; upstream fix is standards#303
Staged specific files only	Single commit touches exactly the three files, no blanket add

One observation (not a blocker)

The GraphQL reference pages GitHub exposes (pulls, repositories, organizations, etc.) are organized by domain and have reorganized before — the enums index that caused this breakage was exactly that. The new pulls page is the right home for MergeStateStatus today. Worth keeping an eye on if the link checker flags it again, but nothing actionable here beyond what's been done.

[claude]

Claude finished @kyle-sexton's task in 1m 7s —— View job

---

Security Review

• Gather context and read changed files
• Analyze PR diff for security issues
• Report findings

---

Scope: Three markdown documentation files, each with a single URL substitution (+1/-1). No code, no configuration, no workflows, no dependency pins touched.

Finding: None.

All three replacements land on the same trusted domains as the URLs they replace:

File	Old domain	New domain
docs/adr/0002-…md	docs.github.com	docs.github.com
plugins/dometrain/README.md	dometrain.com	dometrain.com
plugins/source-control/…/freshness.md	docs.github.com	docs.github.com

No homograph substitution, no lookalike domains, no redirect chains. The URLs are referenced only as hyperlinks for human readers — no code in the repo fetches or processes them programmatically, so there is no injection surface, open-redirect risk, or SSRF vector to consider.

No secrets, credentials, tokens, GitHub Actions changes, permission changes, or dependency-pin changes are present. Nothing to report from a security standpoint.

[claude]

Claude finished @kyle-sexton's task in 1m 17s —— View job

---

PR Review

• Gather context and read changed files
• Review diff (including new commit)
• Post findings

---

LGTM. This PR now contains two commits. The net cumulative change is still exactly 3 files, +3/-3 — no scope creep.

New commit (6898e83) — what changed and why it's correct

The initial commit (7b30fb6) replaced the dead ADR link with pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks. An independent verification caught that this path is itself a 301 redirect to the canonical location.

The follow-up commit (6898e83) resolves that to the direct URL:

https://docs.github.com/en/pull-requests/how-tos/merge-and-close-pull-requests/troubleshooting-required-status-checks

This is the right call. A redirect is a second artifact that can be retired independently of the content — using the final resolved URL removes that fragility. The commit message documents the verification (301 vs. 200, lychee clean after).

Full change summary (origin/main → HEAD)

File	Change
docs/adr/0002-…md L89	repositories/…/managing-protected-branches/troubleshooting-… → pull-requests/how-tos/merge-and-close-pull-requests/troubleshooting-… (canonical, 200 direct)
plugins/dometrain/README.md L10	/pro/ → /dometrain-pro/ slug rename
plugins/source-control/…/freshness.md L18	graphql/reference/enums#mergestatestatus → graphql/reference/pulls#enum-mergestatestatus (fragment present in served HTML)

Process/guideline checks

Check	Result
Branch naming	fix/640-link-check-report ✓
PR body — closing keyword	Fixes #640 ✓
PR body — ## Related section	Present ✓
Plugin version bump	Correctly omitted — no behavioral contract change ✓
lychee.toml not touched	Correct — managed component; upstream in standards#303 ✓
Specific files staged only	Both commits touch only the exact files changed ✓

No issues found.

[claude]

Claude finished @kyle-sexton's task in 1m 5s —— View job

---

Security Review

• Read PR diff and changed files
• Analyze for security vulnerabilities
• Post findings

---

Scope: Three markdown documentation files, each with a single URL substitution (+1/−1). No code, configuration, workflows, secrets, dependency pins, or permissions touched.

Finding: None.

All three replacements land on the same trusted domains as the URLs they replace:

File	Old URL	New URL	Domain change?
docs/adr/0002-…md L89	docs.github.com/…/managing-protected-branches/troubleshooting-required-status-checks	docs.github.com/…/merge-and-close-pull-requests/troubleshooting-required-status-checks	No — path rename only
plugins/dometrain/README.md L10	dometrain.com/pro/	dometrain.com/dometrain-pro/	No — slug rename only
plugins/source-control/…/freshness.md L18	docs.github.com/…/graphql/reference/enums#mergestatestatus	docs.github.com/…/graphql/reference/pulls#enum-mergestatestatus	No — page + fragment rename only

No homograph substitution, no lookalike domains, no redirect chains introduced. The URLs are referenced only as hyperlinks for human readers — no code in the repo fetches or processes them programmatically, so there is no injection surface, open-redirect risk, or SSRF vector. No secrets, credentials, tokens, GitHub Actions changes, permission changes, or dependency-pin changes are present.

Nothing to report from a security standpoint.