docs: one owner for the one-log rule, and an honest scope on the census

The one-work-log rule was written near-verbatim in four places — okf-spec,
okf-maintenance, log.md's preamble, and APPEND_SYSTEM.md. Four copies is four
authorities: each can be edited alone, and the next reader cannot tell which one the
linter implements. okf-spec.md owns it; maintenance now carries the action (collapse
a second log into the root, then re-run the linter) instead of re-arguing it; the log
page points at the rule rather than restating it. APPEND_SYSTEM keeps its imperative —
a system prompt cannot fetch a link at the moment of writing — but no longer carries
the duplicated reasoning.

`inventory/index.md` advertised "all userspace program configuration on the
workstation". The one page in that directory measures `~/.config` on blankpad: not
`~/.local/share`, not system package state, not the servers. A coverage claim that
names what was measured is the difference between a census and an alibi.

Refs #60

omp-docs/log.md

@@ -16,9 +16,8 @@ lesson, a few lines. Full incident narratives are recoverable from git
 (`git log --follow omp-docs/log.md`); knowledge that outlives an entry lives
 on its concept page, linked here. Never re-expand an entry in place.
 
-This page is the bundle's **only** work log: one file, at the root. Never start a
-second one in a subdirectory or under another name — `scripts/kb-lint.sh` reports any
-`log.md` that is not this one.
+This is the bundle's only work log; [references/okf-spec.md](references/okf-spec.md) owns the
+one-log rule and `scripts/kb-lint.sh` enforces it.
 
 ## 2026-10-21 — reviewing a day of work, and finding checks that lie
 
@@ -45,6 +44,11 @@ rather than its argument, so the suite asserted the mask was set and per-card ba
 unobtainable on the 2×R9700 box. Model the platform rule in the stub and the existing test goes
 red against the old code — that is the red-proof worth having.
 
+Same shape in `remote-job.sh status`: it globbed its arguments, so a job named `x*` was reported
+as whatever happened to match in the caller's directory. A name is data — split it (`read -a`),
+never let the shell expand it — and a multiplexed `tail` with no jobs says "no jobs" instead of
+handing `*.out` to tail and reporting a missing file.
+
 Incident, found while verifying the gate: the live-sync heartbeat had failed three hourly ticks,
 because a managed skill that documents how to write a secret gate quotes the vendor's all-zeros
 placeholder id and the gate's shape rule fired on the documentation. Prose about credentials is
@@ -53,6 +57,13 @@ the hole. Placeholder judgement reads the matched token — plus what follows it
 quantifier truncates `EXAMPLE` to `EXA` — never the whole line. `ALLOW_SECRETS` stays the only
 override, and the heartbeat's own payload was replayed through the fixed hook to prove it lands.
 
+The rest of #60 was claims about the machine that the machine had stopped honouring:
+`.gitignore` and `deploy.sh`'s exclusion list had drifted apart (`Noctalia*` was excluded, never
+ignored), `.gitattributes` was the stated reason `git-lfs` was installed — for wallpapers that
+same week's diff untracked, and the one-log rule was restated in four owners. A coverage claim
+names what was measured; a tool justified by dead config is a tool nobody can defend when the
+config goes.
+
 ## 2026-10-21 — a documented mode the panel never had
 
 The home ultrawide had been running at 60 Hz for weeks while `desk-1-home.kdl`