docs: log the template adoption, with next action and blockers

Step 6 of docs/WORK_CYCLE.md. Records what the adoption proved rather than
what it did — the two facts that were not known this morning are that the lead
database is restorable, and that three defects were sitting in the tree that
the adopted tooling found on the way in.

Next action: start Batch 10 (accessibility), #189 first, and walk the pages
keyboard-only before fixing anything — all six were found by reading markup.

Blockers: none on this work. Six issues are blocked on the site owner, two of
which are unsubstantiated claims live on the site since May.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/history/DEVELOPMENT_LOG.md

@@ -48,8 +48,83 @@ sequence would have implied more.
 
 ### 2026-08-18 — Adopted the project template
 
-Placeholder — replaced at the end of this session with the real entry, which
-carries Next action and Blockers.
+Merged `~/.openclaw/Projects/Template` into this repository. It was the
+worked example in that template's own README — *"every one of the 205 in the
+repository that had never adopted the convention"* — and the numbers matched
+exactly: 205 issues, zero milestones, severity labels spelled `P0 Critical` /
+`P1 High` / `P2 Medium`, and privacyllc.dev reporting the project as **not
+adopted** rather than as 87% complete.
+
+**The repository was made private first.** Six documents were gitignored with
+the comment *"never commit"*, and committing them into a public tree was not
+the same decision as committing them at all. `null/fruit-fall` is already
+private and reports normally, so nothing was lost by it. That is what made
+`Exempt:` lines unnecessary — this project exempts nothing.
+
+**What moved.** `FUTURE.md` was the markdown backlog and is gone; every open
+item in it was already an issue, so nothing needed migrating into the tracker
+and only its reasoning survives, in `BATCH_LEDGER.md`. `HISTORY.md` and the old
+`DEVELOPMENT_LOG.md` are the two blocks below this one, verbatim, zero lines
+lost. `PROJECT.md`, `STRUCTURE.md`, `BUILD_SUMMARY.md` and `SCRIPTS.md` were
+absorbed and deleted. Four tracked documents moved into `docs/` as git renames.
+
+**What was kept because this project earned it:** the five-agent pipeline, the
+design system in `OVERHAUL_PLAN.md`, the positioning argument in
+`REDESIGN_REVIEW.md`, and `REQUIREMENTS.md` whole including its change policy.
+
+**What was deleted from the template because it does not apply here:** QA pass I
+(no money moves), the authorisation checklist group and the session-token row
+(no accounts, no sessions anywhere in the product), and one *(precautionary)*
+paragraph in `SECURITY.md` about holding credentials on behalf of users. That
+last one is a precautionary rule dropped deliberately and it is named in
+`DOC_TRUST_MAP.md` so nobody has to guess whether it was an oversight.
+
+**Ten scripts, configured rather than copied.** `backup.sh`'s ENGINE block was
+rewritten for SQLite and `restore-check.sh` was rewritten outright — the
+template's is `pg_restore` and `psql` end to end with no seam to configure.
+Three guards in `scripts/verify.d/`, because `verify.sh` detects nothing in a
+project with no test runner and would otherwise exit 2.
+
+**Every guard was proven to fail before being trusted**, per `GUARDS.md` §1.
+The one worth naming: `secrets.sh` was pointed at the real historical leak
+replayed out of commit `033bdf6`, and caught all three Zoho tokens.
+
+**What it proved.** Two things that were not known this morning:
+
+1. **The lead database is restorable.** `backup.sh` took a verified snapshot
+   from the running container and `restore-check.sh` replayed it from SQL into
+   a scratch database — 2 tables, 3 rows, under a second. Before today nothing
+   had ever backed it up and nothing had ever restored it.
+2. **Three defects, found by the tooling on the way in.** `zoho-setup.md` told
+   admins to edit `server/zoho/`, a directory that has never existed in any
+   commit; `README.md`'s route list still advertised `/8x8`, removed at
+   `0.6.6`, and omitted `/privacy-policy`; and `check-env.sh` found
+   `CORS_ORIGIN` naming a host the site is not served from, with a trailing
+   slash, drifted from what `docker-compose.yml` commits. The first two were
+   fixed in the same commit. The third is filed, because choosing the right
+   origin is not mine to decide.
+
+**Four issues filed and no more.** Every open issue is a denominator. A test
+suite was deliberately *not* filed for — nobody has decided to build one, and
+inventing that work would make every percentage wrong in one direction. It is
+recorded as a standing gap in `ClaudeQACoverage.md` instead.
+
+- **Closed:** none. Nothing was finished today that was open before it; the
+  work was structural. The 178 already-closed issues were assigned to
+  `Batch 00 — Pre-convention history`, which was then closed as the batch that
+  shipped.
+- **Next action:** Start `Batch 10 — Accessibility WCAG 2.1 AA`, with #189
+  (missing focus rings on all link elements) first — it is the widest of the
+  six and the only one that affects every page. All six were found by reading
+  markup rather than by testing, so begin by walking the home, services and
+  contact pages keyboard-only at 320px and confirm the six are the whole list
+  before fixing any of them.
+- **Blockers:** None blocking this work. Five issues are blocked on the site
+  owner and cannot move without them — #68, #110, #162 and #213 in `Batch 13`,
+  and #69 and #70 in `Batch 14`. Two of those, #108 and #110, are live claims
+  on the site the business may not be able to substantiate, which is a
+  credibility exposure rather than an engineering one and has been open since
+  May.
 
 ---