docs: remove the second contributing note and its dead pointers

CONTRIBUTING-AI.md pointed contributors at a CLAUDE.md "checked in and
kept current"; that file is not in the repository, so the pointer and
the twenty references to it in folder READMEs, docs and comments led
nowhere. The note goes; its one lasting rule (whoever commits a change
stands behind it, no real names, no live health figures, no secrets)
moves into CONTRIBUTING.md. The folder READMEs keep their own content
and drop the dead link, and a reference to the unpublished planning
folder goes with it.

The checked-in .mcp.json was a local editor config no workflow reads;
it is untracked and ignored now. The translation tiers are described
as machine-translated first drafts reviewed by the community, and the
list names Russian, which it missed.

src/README.md

@@ -23,4 +23,4 @@ client → src/proxy.ts → src/app/<route>/route.ts → src/lib/api-handler.ts
 
 ## Conventions
 
-See [`../CLAUDE.md`](../CLAUDE.md) for the full set. The load-bearing ones: RSC by default (`"use client"` only when a hook/state/browser API needs it); every API route wraps `apiHandler` and parses its body with Zod `safeParse`; `userId` is always narrowed from session or Bearer, never accepted as a body field; TanStack Query keys come only from `src/lib/query-keys/`; outbound HTTP goes through `src/lib/safe-fetch.ts`.
+The load-bearing ones: RSC by default (`"use client"` only when a hook/state/browser API needs it); every API route wraps `apiHandler` and parses its body with Zod `safeParse`; `userId` is always narrowed from session or Bearer, never accepted as a body field; TanStack Query keys come only from `src/lib/query-keys/`; outbound HTTP goes through `src/lib/safe-fetch.ts`.

src/__tests__/labs-module-ai-gate-guard.test.ts

@@ -22,8 +22,7 @@
  * that file does, or is listed below by file and function with the reason
  * its rows cannot reach a prompt. A new reader fails here until it does one
  * of those. The data routes are not in scope: a module decides what a model
- * is given, not what the owner can read (`CLAUDE.md`, "An AI capability
- * gates model work").
+ * is given, not what the owner can read.
  *
  * The check is per read, not per file. It used to ask whether a file that
  * reads the table mentions the gate anywhere, so one ungated read in a file

src/__tests__/session-surface-guard.test.ts

@@ -43,7 +43,7 @@ const SRC = join(process.cwd(), "src");
  * Every non-test `.ts` / `.tsx` under `src/app/`, which is the whole of the
  * request-handling tree: API routes, RSC pages, layouts, route handlers.
  * The generated Prisma client is excluded by construction (it is not under
- * `app/`) and never read — see CLAUDE.md.
+ * `app/`) and never read.
  */
 function appFiles(): string[] {
   return walkSourceFiles(SRC, { floor: 3000 })

src/__tests__/sharing-surface-guard.test.ts

@@ -161,7 +161,7 @@ const BARE_REQUIRE_AUTH_FLOOR = 200;
  * omits the three routes under `src/app/.well-known/` — three request handlers
  * that a glob-based sweep reports as if they did not exist. Leg (a) pins one of
  * them by name so this cannot quietly regress. Names only; nothing under
- * `generated/` is ever read (CLAUDE.md).
+ * `generated/` is ever read.
  */
 function allPaths(): string[] {
   return readdirSync(SRC, { recursive: true })

src/app/README.md

@@ -22,4 +22,4 @@ Every endpoint wraps its handler in `apiHandler` (`@/lib/api-handler`), parses a
 
 ## Conventions
 
-See [`../../CLAUDE.md`](../../CLAUDE.md). The request-flow walk in `.planning/codebase/arch.md` annotates each layer with file:line citations. Related dirs: handlers compose [`../lib/`](../lib/README.md); pages render [`../components/`](../components/README.md).
+Related dirs: handlers compose [`../lib/`](../lib/README.md); pages render [`../components/`](../components/README.md).

src/components/README.md

@@ -21,4 +21,4 @@ React components. The UI primitives are shadcn/ui (new-york style, zinc base) ov
 
 ## Conventions
 
-Kebab-case filenames; React component exports stay PascalCase regardless. (A handful of PascalCase-filename outliers under `medications/` + `onboarding/` are pre-existing drift, noted in [`../../CLAUDE.md`](../../CLAUDE.md).) Every `t()` call needs a matching key in `messages/en.json` — guarded by `i18n-call-site-coverage.test.ts`. Data reads go through TanStack Query with keys from `@/lib/query-keys` and unwrap `(await res.json()).data`. Tests live in [`__tests__/`](__tests__/).
+Kebab-case filenames; React component exports stay PascalCase regardless. Every `t()` call needs a matching key in `messages/en.json` — guarded by `i18n-call-site-coverage.test.ts`. Data reads go through TanStack Query with keys from `@/lib/query-keys` and unwrap `(await res.json()).data`. Tests live in [`__tests__/`](__tests__/).

src/lib/README.md

@@ -30,4 +30,4 @@ The server and runtime toolkit. Everything that is not a page, component, or rou
 
 ## Conventions
 
-Kebab-case filenames. See [`../../CLAUDE.md`](../../CLAUDE.md) "Code conventions" and "Security-relevant patterns"; the critical-files map there cites the exact entry points. Most modules carry tests in a sibling `__tests__/`.
+Kebab-case filenames. Most modules carry tests in a sibling `__tests__/`.

src/lib/jobs/insight-pregenerate.ts

@@ -46,7 +46,7 @@
  * provider-less account costs one cheap chain-resolve and no LLM call.
  *
  * Recurring pg-boss task — never runs inside an HTTP request and never
- * shells out to `tsx` (CLAUDE.md DO-NOTs).
+ * shells out to `tsx` (the production image has none).
  */
 import { activeAccount } from "@/lib/account-deletion/active-account";
 import { createHash, randomUUID } from "node:crypto";

src/lib/jobs/insight-status-generate.ts

@@ -16,7 +16,7 @@
  * polls the read-only GET until it lands.
  *
  * Recurring/event pg-boss task — never runs inside an HTTP request and
- * never shells out to `tsx` (CLAUDE.md DO-NOTs). Registered in the
+ * never shells out to `tsx` (the production image has none). Registered in the
  * reminder-worker `allQueues` loop + a `boss.work` handler; a queue built
  * but never registered silently never drains (the v1.4.37 W10 incident),
  * so a guard test pins the registration.

src/lib/jobs/period-narrative-warm.ts

@@ -17,7 +17,7 @@
  * so a provider-less / sparse account costs only the context build.
  *
  * Recurring pg-boss task — never runs inside an HTTP request, never shells out
- * to `tsx` (CLAUDE.md DO-NOTs).
+ * to `tsx` (the production image has none).
  */
 import { ACTIVE_ACCOUNT } from "@/lib/account-deletion/active-account";
 import type { PrismaClient } from "@/generated/prisma/client";

src/lib/logging/redact.ts

@@ -150,7 +150,7 @@ export function redactSecrets(input: string): string {
       // calendar-feed link (#1350).
       // Same boundary-aware shape as the `sk-` rule. The
       // idempotency replay-cache already rejects bodies containing
-      // these prefixes (CLAUDE.md headless-client-API patterns); this
+      // these prefixes; this
       // is the matching egress guard for log/error surfaces.
       .replace(/(^|[^A-Za-z0-9])hl[kpresvf]_[A-Fa-f0-9]{32,}/g, "$1[REDACTED]")
       // v1.22.0 — the MCP OAuth bridge artifacts: the authorization code

src/lib/mood/context.ts

@@ -10,7 +10,7 @@
  * both directions.
  *
  * Everything is built field by field from the parsed body. Nothing is spread
- * from a request (`CLAUDE.md`, no mass assignment), and the two multi-select
+ * from a request (no mass assignment), and the two multi-select
  * lists go through the vocabulary module's encoder rather than a local
  * `JSON.stringify`.
  */

src/lib/validations/mental-health.ts

@@ -3,8 +3,7 @@
  * (PHQ-9 / GAD-7; v1.27.9 adds WHO-5 + SCI). The item answers are small
  * integers whose ceiling is instrument-specific (PHQ/GAD 0–3, SCI 0–4,
  * WHO-5 0–5); the array length must match the instrument. `userId` is NEVER
- * a body field — it is narrowed from the session in the handler (CLAUDE.md
- * convention).
+ * a body field — it is narrowed from the session in the handler.
  */
 import { z } from "zod/v4";
 import {