docs(release): record the 1.9.16 fixes in changelog and README

Dates the 1.9.16 section and folds this branch's work into it: the DDD
paradigm and ceremony-audit lens, the select! and memory-allocation
review lenses, the CI gate and typecheck fixes, and the capture-index
consistency fixes.

README's What's New leads with DDD as the fourteenth architecture
paradigm and notes the infrastructure work behind it.

Author: Test User

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.9.16] - 2026-07-14
+
 ### Added
 
 - **Domain-Driven Design paradigm and the ceremony-audit review
@@ -34,8 +36,58 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - `.claude/rules/ceremony-requires-need.md`: no DTO, mapper, command
     object, or layer boundary without a named, current need.
 
+- **`select!` orchestration rule and memory-allocation review
+  lenses (pensive).** Two review capabilities landed as new modules
+  inside existing skills (Fixes #598, #599):
+  - `rust-review` `concurrency-patterns` module: a rule flagging
+    hand-rolled multi-task orchestration (2+ `tokio::spawn` handles
+    torn down with consecutive `abort()` calls around an
+    mpsc-shared sink) that a single `select!` loop expresses more
+    safely, carrying the cancel-safety and head-of-line-blocking
+    caveats the rewrite introduces. Wired into `/rust-review` and
+    the `rust-auditor` agent.
+  - `performance-review` `memory-allocation-lenses` module: three
+    manual lenses for allocation blow-ups that keep unit tests
+    green: unbounded collections fed from an external source,
+    hot-path recompute that should be memoized behind a generation
+    counter, and serial blocking I/O over an unbounded set. Written
+    as review lenses, not AST detectors, so the performance-review
+    detector-test rule visibly does not apply to them.
+
 ### Fixed
 
+- **Two URLs with identical content desynced the capture index
+  (memory-palace).** The web-capture guard was `is_known(url=...)`,
+  which consults URLs only, so a new URL serving bytes already on disk
+  (an empty API result, a mirror, a redirect target) fell through to
+  `update_index`. That overwrote `hashes[content_hash]` with the second
+  capture's path and left the *first* entry pointing at a file the hash
+  map no longer agreed with, plus a duplicate copy of the content on
+  disk. `update_index` is now content-addressed: an entry whose bytes
+  are already stored adopts the canonical location, so `entries` and
+  `hashes` cannot disagree by construction. The capture hook checks
+  `get_stored_at` first and indexes the new URL against the existing
+  file rather than storing a second copy.
+
+- **Pruning one of two entries sharing a capture destroyed the
+  survivor's dedup memory (memory-palace).** `apply_orphan_prunes`
+  popped the hash mapping unconditionally (its comment claimed a
+  `stored_at` check the code never made). When two URLs shared one
+  piece of content and only one was orphaned, the survivor's
+  `content_hash` was left dangling, `is_known` reported its content
+  unseen, and the next fetch re-captured a file already on disk.
+  Removal is now refcount-aware: a mapping is dropped only when no
+  surviving entry references it.
+
+- **The committed capture index was guarded by no test
+  (memory-palace).** The index invariants were pinned only against
+  synthesized `tmp_path` fixtures, and those fixtures derived each hash
+  from the URL, so no two entries could ever collide and the bugs above
+  were unreachable from the suite. `tests/test_capture_index_artifact.py`
+  now runs the same invariants against the artifact that actually ships:
+  no dangling hashes, no orphan mappings, `entries` and `hashes` agreeing
+  on `stored_at`, and required fields present.
+
 - **Paradigm test harness could silently skip a new paradigm
   (archetypes).** `EXPECTED_COMPONENTS` was the only thing driving the
   parametrize, so a fourteenth paradigm could land on disk untested. The
@@ -90,30 +142,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   trigger now matches `pyproject.toml` as well, which is what
   `typecheck.yml` already watched.
 
-## [1.9.16] - 2026-07-05
-
-### Added
-
-- **`select!` orchestration rule and memory-allocation review
-  lenses (pensive).** Two review capabilities landed as new modules
-  inside existing skills (Fixes #598, #599):
-  - `rust-review` `concurrency-patterns` module: a rule flagging
-    hand-rolled multi-task orchestration (2+ `tokio::spawn` handles
-    torn down with consecutive `abort()` calls around an
-    mpsc-shared sink) that a single `select!` loop expresses more
-    safely, carrying the cancel-safety and head-of-line-blocking
-    caveats the rewrite introduces. Wired into `/rust-review` and
-    the `rust-auditor` agent.
-  - `performance-review` `memory-allocation-lenses` module: three
-    manual lenses for allocation blow-ups that keep unit tests
-    green: unbounded collections fed from an external source,
-    hot-path recompute that should be memoized behind a generation
-    counter, and serial blocking I/O over an unbounded set. Written
-    as review lenses, not AST detectors, so the performance-review
-    detector-test rule visibly does not apply to them.
-
-### Fixed
-
 - **Leaked git environment in the plugin test runner (scripts).**
   Every test invocation now runs behind `scripts/without-git-env.sh`,
   which unsets the whole `GIT_*` prefix before handing off to the

README.md

@@ -164,17 +164,32 @@ unavailable, and both can be turned off.
 
 ## What's New
 
-**1.9.16** adds two `pensive` review capabilities, landed as modules
+**1.9.16** adds Domain-Driven Design as the fourteenth architecture
+paradigm, along with the review lens that enforces it. The
+`archetypes:architecture-paradigm-domain-driven` skill treats DDD as
+modeling a business in its own language, and treats layering, mapping,
+DTOs, and command objects as separable machinery a domain model may or
+may not need. Its companion `ceremony-audit` module in
+`pensive:architecture-review` reviews for passthrough mappers, twin
+types, and speculative DTOs, with an IO-boundary counter-signal so it
+does not flag a boundary mapper doing real work.
+
+The release also adds two `pensive` review capabilities as modules
 inside existing skills. The `rust-review` skill gains a
 `concurrency-patterns` rule that flags hand-rolled multi-task
 orchestration (several `tokio::spawn` handles torn down with
 consecutive `abort()` calls) that a single `select!` loop expresses
 more safely. The `performance-review` skill gains three manual
 memory-allocation lenses: unbounded collections from an external
 source, hot-path recompute that should be memoized, and serial
-blocking I/O over an unbounded set. Both are review lenses a reviewer
-applies by reading the code, with no AST automation behind them.
-See the [CHANGELOG](CHANGELOG.md) for the full history.
+blocking I/O over an unbounded set. These are lenses a reviewer applies
+by reading the code, with no AST automation behind them.
+
+On the infrastructure side, `cartograph`'s 40 tests now run in a gate
+that previously reported them as a clean skip, and the typecheck gate
+resolves mypy from each plugin's own environment so it means the same
+thing locally and in CI. See the [CHANGELOG](CHANGELOG.md) for the full
+history.
 
 ## Plugin Development
 

docs/api-overview.md

@@ -1,6 +1,6 @@
 # API Overview
 
-*Updated: 2026-07-05*
+*Updated: 2026-07-14*
 
 ## API Surface Summary