Wave 7 prep - record the Aug 18 decisions as D1-D10 and amend the waves

Nick answered 21 questions at the wave 6 exit and 11 follow-ups. Seven answers
are new build work, three amend acceptance criteria on tasks already scheduled,
and two close questions without work. None of it had an item ID, so none of it
could be built under CLAUDE.md's first rule.

New items D1-D10 in docs/waves/decisions-2026-08-18.md. A new prefix rather than
widened CR/F/S/A/B/C numbers - those are referenced in documents outside this
repo and CLAUDE.md forbids reinterpreting them. Every D entry names the item it
amends and quotes the criterion it replaces, so a reader of R2 can see what moved.

  D1  sample data returns to the creator                    B7, S7   T7.1
  D2  QA distribution list configured in the SOP            CR-014   T7.6
  D3  side navigation and collapsible sections, not tabs    F6       T7.2
  D4  Urgent surfaces the audited override, never bypasses  CR-003/A1 T7.3
  D5  usage data moves to the admin console                 B7       T7.10 (new)
  D6  material list uploads at SOP configuration            CR-013   T8.6  (new)
  D7  archived projects readable by project admins          B3, C1   T9.8  (new)
  D8  5MB a file, 2GB a project, PDFs and images, one DB    CR-007   T7.7
  D9  Ready for QA appears in Field View                    CR-014   T7.6
  D10 email switched on and off from the admin console      CR-011/14 T7.6, T8.3

Two decisions were mine to make and are recorded as such. D3: the written F6
criterion (no view over two screen heights) and the answer (one long form with
side nav) cannot both hold, so the criterion now reads 'at rest' and sections
collapse by default - tabs hide sections a first-time author does not know exist.
D8: keeping 5MB files in the same database means every encrypted backup carries
them; splitting them out was rejected because a backup without the drawings
cannot restore, so a 2GB per-project ceiling was approved instead.

Also corrected, not amended: CLAUDE.md and IMPLEMENTATION.md X2 both cited
wp-creation-app.js:1962-1972 as the protected logged-override path that T7.3 is
forbidden to remove. Those lines are deletePackage() and clearSaved(). The path
is confirmEarlyRelease() at :1002. Both documents now name it by function so the
reference survives the T7.1 rewrite that is about to move it.

Wave 9 gains T9.9, a sweep of the nine backlog entries that name wave 9 as their
home. Left unscheduled they surface at T9.7, which has no room to fix anything.
The four colour items in it (BL-004/005/008/009) are now approved work.

T9.5's help-tip count corrected from 15 to 18 and dated: three were added during
waves 5 and 6 by tasks reusing the component as designed, each unreachable for
the same reason. Scheduling a broken component late makes every reuse cost more.

Closed without work: the free-text location migration. Every location on record
is sample data because no real list has been loaded, so there is nothing to
migrate. Recorded with the condition that invalidates it - the first real
project - so it is a decision rather than a surprise.

Items: D1 D2 D3 D4 D5 D6 D7 D8 D9 D10
Task: T7.0 (wave 7 prep)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -5,13 +5,15 @@ any task, and read the wave file for the task you are on. Do not work from this
 
 ## The spec is the source of truth
 
-Every change traces to an item ID (`CR-001`, `F1`, `S1`, `A1`, `B1`, `C1`). If you are about
+Every change traces to an item ID (`CR-001`, `F1`, `S1`, `A1`, `B1`, `C1`, `D1`). If you are about
 to make a change that has no ID, stop. Either it belongs to an existing item and you should
 say which, or it is out of scope and should be logged in `docs/waves/backlog.md` instead of
 built.
 
 Do not renumber, merge, or reinterpret item IDs. They are referenced in documents outside
-this repo that other people are reading.
+this repo that other people are reading. New scope decided mid-build gets a **new** ID rather
+than a widened old one - that is what the `D` prefix is for. See
+`docs/waves/decisions-2026-08-18.md`.
 
 ## Scope discipline
 
@@ -51,7 +53,11 @@ These are recorded decisions, not oversights. Do not "clean them up":
 - **Uppercase card headers in `console.css` stay (A5).** The sentence-case rule applies to
   buttons and field labels only. The uppercase header idiom is deliberate.
 - **The logged-override path for predecessors stays (A1).** It is an audited business rule,
-  not a bug. See `wp-creation-app.js:1962-1972`.
+  not a bug. It is `confirmEarlyRelease()` in `wp-creation-app.js`, called from the issue and
+  release paths. Named by function, not by line: this file and `IMPLEMENTATION.md` X2 both
+  cited `wp-creation-app.js:1962-1972` until Aug 18 2026, and those lines are
+  `deletePackage()`/`clearSaved()` - a different rule entirely. Corrected before T7.3, which
+  is the task told not to remove it.
 - **Removed fields are hidden, not deleted (CR-002, CR-016).** Retain the data and the model.
   Removal is expressed through the CR-006 section toggles.