Renumber LLP 0164 -> 0166 to resolve a cross-branch number collision

Three open branches independently minted 0164 off the same master
high-water mark, none able to see the others:

  fix/issue-421 (PR #502)  status-names-recent-clients-from-gateway-entrypoints
  fix/issue-473 (PR #517)  codex-flat-pair-needs-a-namespace-signal -> 0165
  fix/issue-451 (PR #520)  session-control-plane-states-its-guarantees -> 0166

PR #502 is held and approved awaiting a human merge, so it keeps 0164.
This branch takes 0166; 0165 went to PR #517.

No content change: the file is renamed and the number updated at every
reference site (3 in session_command.js, 1 in the new responder-trust
test, the Extended-by forward-ref in LLP 0067, and the doc title). The
#stated-not-proved and #membership-not-grain anchors still resolve.

Author: test

hypaware-core/plugins-workspace/ai-gateway/src/session_command.js

@@ -60,7 +60,7 @@ const EPHEMERAL_NOTE =
  * reader pasting the output into a support thread should not have to reconstruct
  * which address was trusted.
  *
- * @ref LLP 0164#stated-not-proved [implements]: the responder is never
+ * @ref LLP 0166#stated-not-proved [implements]: the responder is never
  * authenticated, and every confirmed answer says so.
  *
  * @param {string} endpoint
@@ -309,7 +309,7 @@ async function runMutation(argv, ctx, method, usage) {
         endpoint: endpoint.endpoint,
         endpoint_source: endpoint.source,
         // Same field, same constant, on the verbs whose output reads as done.
-        // @ref LLP 0164#stated-not-proved [implements]
+        // @ref LLP 0166#stated-not-proved [implements]
         endpoint_authenticated: false,
       }) + '\n'
     )
@@ -357,7 +357,7 @@ function writeStatus(ctx, json, report) {
         // Constant by contract, `unknown` reports included: it is `false`
         // because no answer this verb can obtain is authenticated, not because
         // this particular one failed a check.
-        // @ref LLP 0164#stated-not-proved [implements]
+        // @ref LLP 0166#stated-not-proved [implements]
         endpoint_authenticated: false,
         folder_policy: 'hyp policy show',
       }) + '\n'
@@ -423,7 +423,7 @@ function writeStatus(ctx, json, report) {
  * asked to, so the weaker source gets its own note. Neither says who answers
  * there NOW, and `validateControlResponse` can prove the responder saw our
  * token but not that it is the gateway, so `responderTrustNote` rides every
- * confirmed answer under both sources (issue #451, LLP 0164). Naming the
+ * confirmed answer under both sources (issue #451, LLP 0166). Naming the
  * evidence in the output is the only remedy available at this layer, and it is
  * this change's own thesis: a control that can be wrong must at least say so.
  *

llp/0067-session-opt-out.design.md

@@ -293,7 +293,7 @@ dependency for one check makes it a separate design decision rather than a
 hardening tweak. Recorded, not adopted; the residual stays mitigated by the
 `endpoint_source` disclosure ([§cli-provenance](#cli-provenance)).
 
-> **Extended-by: [LLP 0164 §stated-not-proved](./0164-session-control-plane-states-its-guarantees.decision.md#stated-not-proved).**
+> **Extended-by: [LLP 0166 §stated-not-proved](./0166-session-control-plane-states-its-guarantees.decision.md#stated-not-proved).**
 > Issue #451 settled the deferred question as **accept and document**: the
 > residual is not closed, and every confirmed answer now states that the
 > responder was never authenticated (`trust:` in the human output,

…-plane-states-its-guarantees.decision.md …-plane-states-its-guarantees.decision.mdllp/0164-session-control-plane-states-its-guarantees.decision.md renamed to llp/0166-session-control-plane-states-its-guarantees.decision.md llp/0164-session-control-plane-states-its-guarantees.decision.md renamed to llp/0166-session-control-plane-states-its-guarantees.decision.md

@@ -1,4 +1,4 @@
-# LLP 0164: the session control plane states its guarantees rather than proving them
+# LLP 0166: the session control plane states its guarantees rather than proving them
 
 **Type:** Decision
 **Status:** Accepted

test/plugins/ai-gateway-session-responder-trust.test.js

@@ -33,7 +33,7 @@ import {
 // responder was never authenticated, in human output and in `--json`, on both
 // endpoint-discovery paths.
 //
-// @ref LLP 0164#stated-not-proved [tests]: an unauthenticated responder is
+// @ref LLP 0166#stated-not-proved [tests]: an unauthenticated responder is
 //   disclosed, on every confirmed answer, rather than silently trusted.
 
 /* ------------------------------------------------------------------ */