chore: sync standards components

REVIEW.md

@@ -20,7 +20,7 @@ section.
 
 ## Severity
 
-This organization's criteria (`conventions/review/` in `standards`) resolve
+This organization's criteria (`standards/review/` in `standards`) resolve
 to three severities: **Critical**, **Important**, **Suggestion**. On this
 surface's three markers:
 
@@ -36,7 +36,7 @@ to the three-tier vocabulary above and not something a criterion assigns.
 
 A finding tagged `blocking` is always 🔴 Important here, regardless of what
 severity its underlying criterion would otherwise carry in context.
-`blocking` is this file's own tag, not a severity a `conventions/review/`
+`blocking` is this file's own tag, not a severity a `standards/review/`
 criterion assigns.
 
 ## Depth
@@ -45,7 +45,7 @@ Managed Code Review cannot resolve a citation below: `@` imports are not
 expanded and cited files are not read into the prompt. A self-hosted or
 local review using the `review` plugin can follow one into the full
 criterion, its severity nuance, and its sources. A citation is a path of the
-form `conventions/review/<file>.md#<heading>`, resolved relative to wherever
+form `standards/review/<file>.md#<heading>`, resolved relative to wherever
 the `standards` checkout root is available: this repository's own root when
 `standards` reviews itself, or the `--add-dir` mount root everywhere else.
 
@@ -68,14 +68,14 @@ Always check:
 - A high-risk security action, such as authentication, an authorization
   failure, a privilege change, or sensitive-data access, has a
   corresponding audit-log
-  entry (`conventions/review/observability.md#logging`). This is an
+  entry (`standards/review/observability.md#logging`). This is an
   observability completeness check on the logging seam; whether the action
   itself is safe is the security lane's question.
 - A change that writes two or more related records, files, or state
   locations carries an atomicity mechanism spanning them: a transaction,
   an atomic rename, a constraint, or a compensation step. An
   interruption between steps must not leave state no code path expects
-  (`conventions/review/error-handling.md#atomicity`).
+  (`standards/review/error-handling.md#atomicity`).
 - No Dependabot pull request waits on a human. One whose updates are all
   non-major, with GitHub Actions only from `actions/*`, `github/*` or
   `anthropics/*`, and none in the policy's `reviewOnly` security-critical
@@ -99,12 +99,12 @@ Always check:
 - A handler or endpoint that receives an object id (a path segment, body
   field, or query parameter) checks the caller is authorized for that
   specific record, not only that the id is well-formed. Tagged `blocking`
-  (`conventions/review/security.md#object-level-authorization`).
+  (`standards/review/security.md#object-level-authorization`).
 - A data-access path that reaches tenant-owned data carries an explicit
   tenant scope. Tagged `blocking`
-  (`conventions/review/multi-tenancy.md#tenant-scoped-data-access`).
+  (`standards/review/multi-tenancy.md#tenant-scoped-data-access`).
 - No secret, token, or credential is added to tracked source or config.
-  Tagged `blocking` (`conventions/review/security.md#secrets-and-credentials`).
+  Tagged `blocking` (`standards/review/security.md#secrets-and-credentials`).
 - A query or process invocation built from external input is parameterized,
   never string-concatenated. Tagged `blocking`
-  (`conventions/review/security.md#trust-boundaries-and-injection`).
+  (`standards/review/security.md#trust-boundaries-and-injection`).

docs/standards/README.md

@@ -5,7 +5,7 @@ standards-contract: 1.0.2
 # Standards index
 
 Team-layer engineering standards synced from melodic-software/standards
-(`conventions/engineering/`). Change them there, not here.
+(`standards/engineering/`). Change them there, not here.
 
 | Surface | Applies when | File |
 |---|---|---|

docs/standards/bulk-mutation.md

@@ -31,6 +31,6 @@ confirm-first variant rather than standing in for consent.
 
 ## Boundaries
 
-- **vs [`deterministic-work-execution.md`](https://github.com/melodic-software/standards/blob/main/conventions/engineering/deterministic-work-execution.md)**:
+- **vs [`deterministic-work-execution.md`](https://github.com/melodic-software/standards/blob/main/standards/engineering/deterministic-work-execution.md)**:
   that file covers producing the count honestly by running a tool. This file
   says when the count is required and what to do with it.

docs/standards/concise-prose.md

@@ -6,14 +6,14 @@ is a reasoning-only judgment: word or sentence counts can flag a passage for
 review, but they cannot prove that a shorter version is equivalent.
 
 This rule owns wording, not whether content belongs or where it lives.
-[`documentation-existence.md`](https://github.com/melodic-software/standards/blob/main/conventions/engineering/documentation-existence.md) owns whether a
+[`documentation-existence.md`](https://github.com/melodic-software/standards/blob/main/standards/engineering/documentation-existence.md) owns whether a
 page may exist at all;
-[`simpler-code.md`](https://github.com/melodic-software/standards/blob/main/conventions/engineering/simpler-code.md) owns reductions to executable code;
-[`progressive-disclosure.md`](https://github.com/melodic-software/standards/blob/main/conventions/engineering/progressive-disclosure.md) owns information
-layering; and [`reference-dont-duplicate.md`](https://github.com/melodic-software/standards/blob/main/conventions/engineering/reference-dont-duplicate.md) and
-[`documentation-and-citations.md`](https://github.com/melodic-software/standards/blob/main/conventions/engineering/documentation-and-citations.md) jointly own
-whether a fact stays inline or is cited. [`naming.md`](https://github.com/melodic-software/standards/blob/main/conventions/engineering/naming.md) owns
-identifiers, and [`legacy-and-migration-debt.md`](https://github.com/melodic-software/standards/blob/main/conventions/engineering/legacy-and-migration-debt.md)
+[`simpler-code.md`](https://github.com/melodic-software/standards/blob/main/standards/engineering/simpler-code.md) owns reductions to executable code;
+[`progressive-disclosure.md`](https://github.com/melodic-software/standards/blob/main/standards/engineering/progressive-disclosure.md) owns information
+layering; and [`reference-dont-duplicate.md`](https://github.com/melodic-software/standards/blob/main/standards/engineering/reference-dont-duplicate.md) and
+[`documentation-and-citations.md`](https://github.com/melodic-software/standards/blob/main/standards/engineering/documentation-and-citations.md) jointly own
+whether a fact stays inline or is cited. [`naming.md`](https://github.com/melodic-software/standards/blob/main/standards/engineering/naming.md) owns
+identifiers, and [`legacy-and-migration-debt.md`](https://github.com/melodic-software/standards/blob/main/standards/engineering/legacy-and-migration-debt.md)
 owns whether historical narration belongs at all. Apply this convention to the
 prose that remains after those decisions.