docs: fan-in caveat + fix audit-verdict roadmap anchors

Glossary § fan-in now points at C.9 closed-dead-subgraph caveat.
audit-delta-attribution plan links audit verdict to Core substrate
section (not Recipe & audit enrichment).

Author: SutuSebastian

docs/glossary.md

@@ -237,7 +237,7 @@ TS shape for one row of the `exports` table.
 
 ### fan-in
 
-Number of edges _into_ a file in the `dependencies` table — `COUNT(*) FROM dependencies WHERE to_path = ?`. Surfaces as the `fan-in` recipe (top files by inbound edges, i.e. **hubs**).
+Number of edges _into_ a file in the `dependencies` table — `COUNT(*) FROM dependencies WHERE to_path = ?`. Surfaces as the `fan-in` recipe (top files by inbound edges, i.e. **hubs**). **Hotspot ranker only** — not an orphan/dead-code detector; N-file packs with sibling imports can all have non-zero fan-in yet be unreachable from a real entry point ([`plans/c9-plugin-layer.md`](./plans/c9-plugin-layer.md) closed-dead-subgraph caveat).
 
 ### fan-out
 

docs/plans/audit-delta-attribution.md

@@ -51,7 +51,7 @@ Baseline-prefix audits without ref-scoped key store; audit verdict + thresholds;
 | A.2 | **Stable finding keys.** Each auditable row maps to a deterministic string key from its delta's `requiredColumns` (canonical column order, joined with `\0` or stable JSON). Same key at base SHA and at HEAD.                           | Existing `AuditDeltaSpec.requiredColumns`           |
 | A.3 | **Reuse audit-cache infrastructure.** Base-side keys come from the sha-keyed extract under `.codemap/audit-cache/<sha>/` (already populated by `git archive` + reindex). Cache key snapshots alongside or derived from the cached index. | [architecture § audit-worktree](../architecture.md) |
 | A.4 | **`--base` path only for v1 attribution.** Baseline-prefix audits (`source: "baseline"`) keep today's flat `added`/`removed` shape unless a follow-up adds historical key stores in `query_baselines`.                                   | Tracer bullet — ship ref-scoped first               |
-| A.5 | **Composable CI.** Consumers filter `added` where `attribution === "introduced"` via SQL/`jq`; complements deferred [audit verdict + thresholds](../roadmap.md#recipe--audit-enrichment).                                                | Roadmap trigger-gated verdict item                  |
+| A.5 | **Composable CI.** Consumers filter `added` where `attribution === "introduced"` via SQL/`jq`; complements deferred [audit verdict + thresholds](../roadmap.md#core-substrate--platform).                                                | Roadmap trigger-gated verdict item                  |
 
 ---
 
@@ -123,4 +123,4 @@ MCP/HTTP: same envelope via `tool-handlers` audit handler — spot-check JSON sh
 ## Dependencies
 
 - Shipped: `audit-worktree.ts`, `runAuditFromRef`, v1 delta registry (`files`, `dependencies`, `deprecated`)
-- Independent of [audit verdict + thresholds](../roadmap.md#recipe--audit-enrichment) (trigger-gated)
+- Independent of [audit verdict + thresholds](../roadmap.md#core-substrate--platform) (trigger-gated)