fix(docs): point every reference at something that exists

Three anchors were wrong, and none of them was guessed: myst builds them
with default_slugify, which appends a hyphen where a heading ends in an
emoji. Computed against the real headings, 'Investor Relations 💹' becomes
'investor-relations-', and two links additionally named a section that does
not exist - the deploy guide has 'Pinning Variants (Single Or Bundle)', not
'Pinning A Single Variant', and the playwright page has 'Triggers', not
'Scenarios'.

The semaphore requirement still told the reader to resolve Open Questions
into Confirmed Decisions after that section was removed.

In the documentation guide, '[here](...)' is an example inside a sentence
about link text, not a link; it is code now.

The contributing index listed tools/makefile for a file named make.md, and
two links in sys-ctl-alm-telegram pointed at roles/, which carries no README
for the directory resolver to find.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -215,7 +215,7 @@ For the full development setup, contribution workflow, testing, and coding stand
 
 ## Invest 💹
 
-We are actively looking for investors to help scale Infinito.Nexus and bring open, self-hosted infrastructure to more organizations worldwide. If you are interested in investing or partnering with us, please reach out via our [Investor Relations](SUPPORT.md#investor-relations) contact.
+We are actively looking for investors to help scale Infinito.Nexus and bring open, self-hosted infrastructure to more organizations worldwide. If you are interested in investing or partnering with us, please reach out via our [Investor Relations](SUPPORT.md#investor-relations-) contact.
 
 ## Code of Conduct 🕊️
 

docs/contributing/actions/deploy.md

@@ -34,7 +34,7 @@ make compose-deploy mode=update apps="<role>"
 ```
 
 - Reuses the existing inventory, keeps app state, runs the deploy only.
-- For multi-variant roles you MUST set `variant=<idx>` (see [Pinning A Single Variant](#pinning-a-single-variant-)) so the reuse path targets the round's folder. Without `variant=`, the reuse target points at `<INFINITO_INVENTORY_DIR>` which only exists for single-variant roles.
+- For multi-variant roles you MUST set `variant=<idx>` (see [Pinning Variants](#pinning-variants-single-or-bundle-)) so the reuse path targets the round's folder. Without `variant=`, the reuse target points at `<INFINITO_INVENTORY_DIR>` which only exists for single-variant roles.
 
 If the reuse path keeps reproducing the same failure and you want to test whether app entity state is involved:
 

docs/contributing/actions/testing/playwright.md

@@ -17,7 +17,7 @@ For what the `files/playwright/playwright.spec.js` of a role MUST contain, see
 ## When to Write ✍️
 
 - You MUST provide Playwright tests for every `web-*` role.
-- For when a spec MUST be added or updated (including the `javascript.js` / `style.css` trigger), see the Scenarios section of [`playwright.spec.js`](../../artefact/files/role/playwright.specs.js.md#scenarios-).
+- For when a spec MUST be added or updated (including the `javascript.js` / `style.css` trigger), see the Triggers section of [`playwright.spec.js`](../../artefact/files/role/playwright.specs.js.md#triggers-when-to-add-or-update-a-scenario-).
 
 ## Role-Local Files 📁
 

docs/contributing/documentation.md

@@ -28,7 +28,7 @@ You MUST use [RFC 2119](https://www.rfc-editor.org/rfc/rfc2119) keywords in all
 ## Links 🔗
 
 - You MUST NOT use the full URL as link text. Use the domain name, `here`, or the filename instead. Never use the full path.
-- After `See`, you MUST use the domain name as link text, not `here`. `here` is only acceptable when the surrounding sentence reads naturally with it (e.g. "More information [here](...)").
+- After `See`, you MUST use the domain name as link text, not `here`. `here` is only acceptable when the surrounding sentence reads naturally with it (e.g. `More information [here](...)`).
 - For communication links such as Matrix, email, or phone, you MUST show only the value itself as link text, without any protocol prefix or URL wrapper.
 
 | Type | MUST NOT | MUST |

docs/contributing/index.rst

@@ -8,4 +8,4 @@ Contribution Guide
    workflow
    environment/setup
    design/principles
-   tools/makefile
+   tools/make

docs/contributing/tools/agents/claude/sandbox.md

@@ -71,7 +71,7 @@ The following directories are never readable, even if a task explicitly requests
 | `~/.aws` | AWS access keys and configuration. |
 | `~/.config/gcloud` | Google Cloud service account credentials. |
 
-`~/.ssh` is intentionally **not** in this list. Denying it would make `git push` over SSH unreachable and defeat the `Bash(git push*)` ask-gate. The trade-off and its mitigations are documented in [security.md](security.md#assumption-10) (Assumption 10).
+`~/.ssh` is intentionally **not** in this list. Denying it would make `git push` over SSH unreachable and defeat the `Bash(git push*)` ask-gate. The trade-off and its mitigations are documented in [security.md](security.md#assumption-10-ssh-is-intentionally-readable-to-allow-git-push-on-ask-) (Assumption 10).
 
 ## Network 🌐
 

docs/requirements/028-web-app-semaphore.md

@@ -198,7 +198,7 @@ Before any implementation work, the agent MUST read [AGENTS.md](../../AGENTS.md)
 
 Execute autonomously; open a clarification only when a decision is genuinely ambiguous and blocking.
 
-1. Resolve the [Open Questions](#open-questions-pending-operator-decision) into [Confirmed Decisions](#confirmed-decisions).
+1. Work from the [Confirmed Decisions](#confirmed-decisions); raise anything still open with the operator before implementing it.
 2. Scaffold the role using [`roles/web-app-openproject/`](../../roles/web-app-openproject/) as the structural template (Postgres consumer, LDAP vars, OIDC, three personas).
 3. Template `compose.yml.j2` + `env.j2` with the `SEMAPHORE_*` matrix (DB, admin bootstrap, secrets, `SEMAPHORE_WEB_ROOT`, conditional `SEMAPHORE_OIDC_PROVIDERS` and `SEMAPHORE_LDAP_*`).
 4. Add Keycloak client auto-provisioning for the Semaphore consumer.

roles/sys-ctl-alm-telegram/README.md

@@ -6,7 +6,7 @@ This role installs and configures the necessary components for sending notificat
 
 ## Overview
 
-Optimized for real-time alerts, this role is a key component of the overall [`sys-ctl-alm-compose` suite](../). It ensures that, upon failure of a critical service, a Telegram message is automatically sent to notify administrators and enable prompt troubleshooting.
+Optimized for real-time alerts, this role is a key component of the overall `sys-ctl-alm-compose` suite. It ensures that, upon failure of a critical service, a Telegram message is automatically sent to notify administrators and enable prompt troubleshooting.
 
 ## Cosmos
 
@@ -30,7 +30,7 @@ The primary purpose of this role is to provide a robust solution for automated T
 - **Service Installation & Configuration:** Installs and configures necessary components (including the `curl` package).
 - **Customizable Templates:** Supports tailored Telegram message templates for service failure notifications.
 - **Secure Notifications:** Leverages systemd to trigger alerts automatically when services fail.
-- **Suite Integration:** Part of the [`sys-ctl-alm-compose` suite](../) which includes related roles such as [sys-ctl-alm-email](../sys-ctl-alm-email/README.md) and others.
+- **Suite Integration:** Part of the `sys-ctl-alm-compose` suite which includes related roles such as [sys-ctl-alm-email](../sys-ctl-alm-email/README.md) and others.
 
 ## Credits