MIP-0064 tasks

Four PRs, stacked. The build comes first because it is the task most likely to change the design: if the Kroki container stack cannot render marola's two Mermaid fences, everything after it is worth rewriting. Link integrity and --strict follow, then the CI rewiring, then the flow docs and the post-deploy check.

#	slug	delivers	tests (must exist before the PR)	depends on
1	mkdocs-build	mkdocs/ (Dockerfile, mkdocs.yml, the three compose files), scripts/mkdocs.sh with --self-test, just docs / just docs-serve, .gitignore for the two build products, hadolint mkdocs/Dockerfile + mkdocs/docker-compose.yml added to quality-other	scripts/mkdocs.sh --self-test; hadolint mkdocs/Dockerfile; MIP §7.1–§7.3 by hand: a non-strict build produces generated-docs/index.html and an <img> at a local .svg rendered from docs/2-Building-marola/ARCHITECTURE.md:221	–
2	strict-links	git mv docs/README.md docs/index.md + the 12 inbound references (AGENTS.md's doc table, .claude/rules/docs.md, scripts/docs-mip-stack.sh, docs/4-Research-and-plans/FUTURE-WORK.md, five MIPs), strict: true in mkdocs.yml, and whatever --strict then rejects — the three link-shaped prose strings are the known candidates	just docs green under --strict — that is the test: it fails the build on any unresolved link across all 90 pages. A missing docs/index.md is not one of those: mkdocs builds it green and simply ships no landing page, so scripts/mkdocs.sh checks for the file itself	1
3	api-docs-rewire	docs/2-Building-marola/API.md (the sidebar page linking the generated trees), api-docs.yml's mkdocs step and its two new path filters (docs/**, mkdocs/**), scripts/build_docs_index.py deleted with its quality-other line and its scripts/repo_stats.py:80 entry	actionlint; python3 scripts/strip_external_scripts.py --check out/docs over the merged tree (mkdocs output + api/); just quality green after the deletion	2
4	docs-live	docs/3-Working-on-the-repo/DEV-FLOW.md and AGENTS.md's doc table describing the new docs flow, MIP-0064 flipped to Implemented	MIP §7.6, after the deploy: marola.dev/docs/ serves the sidebar and search, marola.dev/docs/api/scala/core/ still resolves, and the Docs tab at site/static/index.html:18 needs no edit	3

Decisions (answering MIP §11 for v1, so no task re-litigates them)

1. No section grouping. docs/*.md stays flat and mips/ is one bucket, ordered alphanumerically by mkdocs' automatic nav. Moving files into concepts/, development/, reference/ means rewriting every inbound link across the repo; it is a separate change, made once the ordering is visible on a live site.
2. AGENTS.md, PHILOSOPHY.md and CONTRIBUTING.md stay out, link-rewritten to GitHub by task 2. They are repo-operating instructions, and pulling them in is what forces decision 1.
3. knowledge/ is out of scope. No task touches it. It is RAG input with its own provenance rules; if it ever ships as a site section that is its own MIP.
4. flake.nix is not extended. A working Docker daemon is the documented prerequisite for just docs. (The MIP said docker-smoke.yml already assumes one on the runner; it does not — it pins ubuntu-latest. Corrected in §5.4 during task 3, and since measured: the stack builds on the self-hosted runner.) Revisit only if someone without one actually needs a preview.
5. --strict arrives in task 2, not task 1. Task 1 cannot build strictly, because the out-of-tree links task 2 rewrites are exactly what strict mode rejects. Task 1's build is non-strict and says so in the recipe comment; task 2 flips it and deletes the comment.
6. Versions are pinned, not floated, at the figures MIP §4.2/§4.3 verified on 2026-09-28: mkdocs==1.6.1, mkdocs-material==9.7.7, mkdocs-kroki-plugin==1.7.0, and yuzutech/kroki:0.32.1 with its kroki-mermaid companion. The reference repo's older pins are not copied; neither is its ServerURL/HttpMethod key casing, which 1.7.0 renamed.
7. docs/README.md becomes docs/index.md by git mv, and the repo root README.md is not copied into the site. The reference does cp ../README.md docs/index.md; doing both here would put two files at the same path, one silently overwriting the other. marola's docs-level index is the better landing page anyway — it says what each doc is for, where the root README is an install page for someone already in the repo. Task 1's mkdocs.sh therefore ships without that cp line, so task 2 does not have to remove it.
8. No link rewriting. Verified 2026-09-28: all 28 relative links in docs/*.md are in-tree (./<file>.md, ./mips/...); AGENTS.md and PHILOSOPHY.md appear in backticks, not as links. The rewrite step an earlier draft specified has no input and is dropped from both the MIP and task 2.

Restack notes

• mkdocs/ matches none of scripts/lib/pr_labels.sh's path→layer rules (lines 101–106), so a PR touching only that directory gets no layer/* label. Task 1 adds the rule with the directory.
• Task 2 edits mkdocs.yml, created by task 1 — one line (strict: true). Task 3 edits the justfile and quality-other, touched by task 1 — one line removed. Both are single-line and in different regions; neither is worth reordering to avoid, but expect them in a restack.
• Nothing after task 2 touches docs/*.md filenames, so the rename lands once.

What shipped

#	PR	note
1	#459	as planned
2	#463	as planned
3	#465	as planned
—	#473	decision 1 reversed. Seeing the flat nav on the built site was the trigger the decision named: docs/*.md moved into 1-Using-marola/ … 4-Research-and-plans/, mips/ became MIPs/, and benchmarks//superpowers/ left the site via exclude_docs. Every inbound link was rewritten in the same PR, which is the cost the decision was deferring
4	#475	the docs flow written down, MIP flipped to Implemented

--strict is what made #473 safe to do at all: the rename broke inbound links across the repo and the build named each one.