Review Absorb from several angles #9546

Absorb is sound in what it can reach. Five of the six boxes are done and the credit box is open. I changed no code, only docs. I read all of Absorb and ran no tests, since nothing changed. Four of the findings need work and are filed as issues; the Without the crew finding needs none.

The findings are in docs/features/absorb-review.md, linked from docs/features/absorb.md.

• Security (#9541, #9542):

- What holds: a declaration alone does nothing. Only a non-agent site admin absorbs. Only people who can read the repository get the menu entry, and /apps/open re-checks access. page is a path on the app's own host. An app cannot set a variable the forge owns. - #9541: every production start rewrites the menu name and page from the app's latest forge.json, so anyone who can push to its default branch can relabel the entry in every reader's menu. For example, they could make it look like "Sign out". The fix is to keep what the admin saw at absorb and ask an admin to accept a changed declaration. - #9542: deleting an app leaves its absorb row and its settings in the database.

• Without the crew: nothing quietly needs a model. Absorb, settings, redeploy and the menu call none, and test/apps-features.test.ts asserts no run starts. The crew cannot absorb either, because agent accounts are refused. That is intended.
• Experience (#9544): an admin finds Absorb only under Settings > Features, with no hint on the app's own page. Absorb and Un-absorb give no preview before they restart the app or change everyone's menu. A refused save loses what was typed. Feature entries sit among the forge's own menu links. The settings pages are not yet in the home page's design language (#9433).
• Product (#9545): a pack cannot say "absorb this app". Absorbed features show nowhere but the menu, with no health on /system and no feed items. A fork of another forge's app carries its feature block with no provenance shown, so an admin absorbs a stranger's menu entry without knowing where it came from.
• Speed (#9543): the Features list and GET /api/v1/features read git for every app on every request. The user menu does a few lookups per absorbed app on every page. I read this from the code and did not measure it, so I claim no regression at the current two features.
• Credit: not done. Ben (benjivers) has no account on this forge, and my token reaches nothing else. This description is the finding for whoever passes it on to him: the review found Absorb's reach sound, with two small gaps (#9541, #9542) and product follow-ups (#9544, #9545).

I did not add a keep_plan plan, because that tool isn't available to me here.

To read it: open docs/features/absorb-review.md and the issues #9541–#9545.

Closes #9441

Absorb is sound in what it can reach. Five of the six boxes are done and the credit box is open. I changed no code, only docs. I read all of Absorb and ran no tests, since nothing changed. Four of the findings need work and are filed as issues; the Without the crew finding needs none.

The findings are in docs/features/absorb-review.md, linked from docs/features/absorb.md.

• Security (#9541, #9542):

- What holds: a declaration alone does nothing. Only a non-agent site admin absorbs. Only people who can read the repository get the menu entry, and /apps/open re-checks access. page is a path on the app's own host. An app cannot set a variable the forge owns. - #9541: every production start rewrites the menu name and page from the app's latest forge.json, so anyone who can push to its default branch can relabel the entry in every reader's menu. For example, they could make it look like "Sign out". The fix is to keep what the admin saw at absorb and ask an admin to accept a changed declaration. - #9542: deleting an app leaves its absorb row and its settings in the database.

• Without the crew: nothing quietly needs a model. Absorb, settings, redeploy and the menu call none, and test/apps-features.test.ts asserts no run starts. The crew cannot absorb either, because agent accounts are refused. That is intended.
• Experience (#9544): an admin finds Absorb only under Settings > Features, with no hint on the app's own page. Absorb and Un-absorb give no preview before they restart the app or change everyone's menu. A refused save loses what was typed. Feature entries sit among the forge's own menu links. The settings pages are not yet in the home page's design language (#9433).
• Product (#9545): a pack cannot say "absorb this app". Absorbed features show nowhere but the menu, with no health on /system and no feed items. A fork of another forge's app carries its feature block with no provenance shown, so an admin absorbs a stranger's menu entry without knowing where it came from.
• Speed (#9543): the Features list and GET /api/v1/features read git for every app on every request. The user menu does a few lookups per absorbed app on every page. I read this from the code and did not measure it, so I claim no regression at the current two features.
• Credit: not done. Ben (benjivers) has no account on this forge, and my token reaches nothing else. This description is the finding for whoever passes it on to him: the review found Absorb's reach sound, with two small gaps (#9541, #9542) and product follow-ups (#9544, #9545).

I did not add a keep_plan plan, because that tool isn't available to me here.

To read it: open docs/features/absorb-review.md and the issues #9541–#9545.

Left #9441 open: 1 unticked item remain (Credit: Ben is told what the crew found, on his forge or wherever he follows this.).