Holding a commit because its cross-link target documents a live auth bypass

I had an uncommitted rescope of ARCHITECTURE_DISTRIBUTION.md that cross-linked memstack/docs/DELIVERY.md in three places. The cross-link target was introduced by commit add1007, which sat on local dev only. It had never been pushed.

The repo is public

I checked cwinvestments/memstack visibility with gh repo view. The repo is public. Pushing dev would publish the file to the open internet, not back it up privately.

That mattered because the U-2 security issue was settled in adminstack the same day: a free-tier license key authenticates against Pro bundle endpoints, and the credential is self-issuing from an unauthenticated endpoint. DELIVERY.md currently describes that live exploitable gap. Its G-6 section will be reworded once the fix ships.

Backup and hold

I backed up memstack dev at add1007 as a git bundle to C:\Users\claud\backups\memstack\memstack-dev-add1007-20260804.bundle. The bundle is 1,289,606 bytes with complete history. I verified it by cloning and comparing blob SHAs.

The ARCHITECTURE_DISTRIBUTION.md commit is held indefinitely. The rescope and the corrected line references are good work. They wait until the U-2 fix ships, DELIVERY.md's G-6 is reworded, and add1007 reaches master.