docs(canon): renumber ADR-008/009 -> ADR-010/011 after ID collision

ADR-008 and ADR-009 were concurrently allocated by two authors on
2026-08-17. adr-008-multi-tenancy-model.md (Four Planes) has earlier
provenance and keeps 008; 009 is left free for that lane. Hub authority
becomes ADR-010, federated namespaces ADR-011. Cross-references in ADR-007
updated.

A live demonstration of ADR-007 decision 1's own subject: sequential
allocation with concurrent writers. ADR numbering is not covered by that
decision, which governs PREFIX-WP-NNNN only — gap to close.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

canon/architecture/adr-007-workplan-identity-and-repo-worker-topology.md

@@ -82,7 +82,7 @@ nothing prevents number reuse.
 **1. A workplan identifier is globally unique.** `PREFIX-WP-NNNN` names exactly
 one workplan across the entire fleet, for all time.
 
-> **Amended 2026-08-17 by `ADR-009` decision 2.** Uniqueness and forward-only
+> **Amended 2026-08-17 by `ADR-011` decision 2.** Uniqueness and forward-only
 > allocation are **namespace-scoped**, not global; global identity is the pair
 > `(namespace, identifier)`, written `PREFIX-WP-NNNN@namespace` when foreign.
 > Global sequential allocation would require a central coordinator — the exact
@@ -103,7 +103,7 @@ It also inverts ADR-001 — a file carrying a hub's private key is the file
 holding hub state.
 
 *Target state (C2).* `state_hub_workstream_id` and `state_hub_task_id` become
-**deterministic**: UUIDv5 derived from the workplan identifier. Per `ADR-009`
+**deterministic**: UUIDv5 derived from the workplan identifier. Per `ADR-011`
 decision 3 the derivation input is the pair `(namespace, identifier)`, not the
 identifier alone — deriving from the identifier alone would make two forks
 holding unrelated work under the same number compute the same UUID. Every instance computes the same value independently, writeback
@@ -120,11 +120,11 @@ Decision 1 must therefore be enforced before derivation ships.
 identifiers into repository files. Other instances may read, project, and serve,
 but must not mint workplan or task UUIDs into git-tracked files.
 
-> **Corrected 2026-08-17, superseded by `ADR-008` decisions 1–3.** This decision
+> **Corrected 2026-08-17, superseded by `ADR-010` decisions 1–3.** This decision
 > originally described workstation hubs as "development read replicas". That was
 > wrong on both counts: the workstation instance was not a replica, and it was
 > the *larger* of the two, holding 306 more workplans than the primary. The two
-> instances were peer databases. `ADR-008` establishes the central hub as
+> instances were peer databases. `ADR-010` establishes the central hub as
 > authoritative and local instances as rebuildable caches, which is what makes
 > this interim rule coherent.
 

canon/architecture/adr-010-hub-authority-and-local-cache-model.md

@@ -1,5 +1,5 @@
 ---
-id: ADR-008
+id: ADR-010
 type: architecture-decision-record
 title: "Hub Authority, Local Cache, and the Two Kinds of Hub Data"
 status: proposed
@@ -8,7 +8,7 @@ date: "2026-08-17"
 tags: ["architecture", "state-hub", "repo-manager", "hub-core", "authority", "cache", "offline", "adr-001"]
 ---
 
-# ADR-008: Hub Authority, Local Cache, and the Two Kinds of Hub Data
+# ADR-010: Hub Authority, Local Cache, and the Two Kinds of Hub Data
 
 ## Status
 

canon/architecture/adr-011-federated-namespaces-and-reconciliation-limits.md

@@ -1,5 +1,5 @@
 ---
-id: ADR-009
+id: ADR-011
 type: architecture-decision-record
 title: "Federated Namespaces, Qualified Identifiers, and the Limits of Reconciliation"
 status: proposed
@@ -8,11 +8,11 @@ date: "2026-08-17"
 tags: ["architecture", "federation", "namespace", "identity", "reconciliation", "fos", "adr-007", "adr-008"]
 ---
 
-# ADR-009: Federated Namespaces, Qualified Identifiers, and the Limits of Reconciliation
+# ADR-011: Federated Namespaces, Qualified Identifiers, and the Limits of Reconciliation
 
 ## Status
 
-Proposed. Amends `ADR-007` decision 1 and extends `ADR-008` decision 4.
+Proposed. Amends `ADR-007` decision 1 and extends `ADR-010` decision 4.
 
 ## Context
 
@@ -77,7 +77,7 @@ lineage, a shared identifier is ambiguous between *the same work, diverged* and
 *different work, colliding* — a distinction that cannot be reconstructed after
 the fact.
 
-**5. Mutable state is derived from an append-only log.** Extending `ADR-008`
+**5. Mutable state is derived from an append-only log.** Extending `ADR-010`
 decision 4: status and other mutable fields are a fold over append-only events
 rather than fields to be reconciled. Reconciliation then becomes union-of-events
 plus re-derivation — deterministic, order-independent, and requiring no
@@ -167,6 +167,6 @@ absolute. Settle before implementation; the notation works either way.
   escalation, sovereignty by default, rebuildability
 - ADR-001 — workplans originate as repo files
 - ADR-007 — identifier uniqueness and derived identifiers (amended here)
-- ADR-008 — hub authority, local cache, and the two kinds of hub data
+- ADR-010 — hub authority, local cache, and the two kinds of hub data
 - `CUST-WP-0058` — instance-per-client tenancy
 - `SHR-INV-0001` — 425-item disposition inventory, T3 cost evidence