[docs] bind branch pagination to repository identity

Signed-off-by: Viwat Vchirawongkwin <viwat.v@chula.ac.th>

Author: yyods

docs/decisions/0042-prefill-official-examples-and-discover-branches.md

@@ -74,13 +74,16 @@ inputs would break existing advanced and reproducible-import workflows.
    and publishes no partial catalog. An empty catalog is displayed honestly
    and cannot be browsed in branch mode.
 
-7. **Keep pagination inside the exact-host boundary.** The client validates
-   GitHub's `Link` pagination metadata, including exact HTTPS host, repository
-   branch path, `per_page`, and strictly increasing `page`. It never directly
+7. **Keep pagination inside the exact-host boundary.** Repository metadata
+   also supplies a positive numeric repository `id`. The client validates
+   GitHub's `Link` pagination metadata, including exact HTTPS host, either the
+   locator-derived `/repos/{owner}/{repo}/branches` path or GitHub's canonical
+   `/repositories/{id}/branches` path bound to that metadata identity,
+   `per_page`, and a `page` that advances by exactly one. It never directly
    follows a response-provided URL; it constructs the next exact
-   `api.github.com` request from validated local values. Each page uses the
-   existing absolute request deadline, cancellation, response-body, error,
-   and rate-limit rules.
+   `api.github.com` request from the validated local locator and page number.
+   Each page uses the existing absolute request deadline, cancellation,
+   response-body, error, and rate-limit rules.
 
 8. **Pin after selection.** A branch catalog and any commit SHA contained in a
    branch-list response are advisory and moving. Browse passes only the chosen

docs/specifications/App/TDD.md

@@ -816,18 +816,21 @@ tablet view. These are hard resource ceilings, not pagination: the subset never
 silently presents a partial folder.
 
 Before normal-mode resolution, `listBranches(locator)` reads repository
-metadata for `default_branch`, then serially reads the public branches endpoint
-with `per_page=100` and increasing `page`. It publishes only a complete
+metadata for `default_branch` and a positive numeric repository `id`, then
+serially reads the public branches endpoint with `per_page=100` and increasing
+`page`. It publishes only a complete
 `GithubBranchCatalog`: at most 512 exact names over six pages, 512 KiB per
 branch page, and 2 MiB across branch-page bodies. Invalid/duplicate names,
 malformed metadata or pagination, a 513th name, or a further page fails without
 publishing accumulated names. `Link` metadata is accepted only when its next
-URL is HTTPS on exact host `api.github.com`, has the exact repository branches
-path and expected page parameters, and advances by one; the returned URL is
-never followed directly. The adapter constructs the next request from its
-validated locator and page number. The reported default is first and selected;
-remaining branches use `String.compareTo`. An empty catalog is displayed and
-cannot Browse in branch mode.
+URL is HTTPS on exact host `api.github.com`, has either the locator-derived
+`/repos/{owner}/{repo}/branches` path or GitHub's canonical
+`/repositories/{id}/branches` path for that metadata identity, carries only
+the expected page parameters, and advances by one; the returned URL is never
+followed directly. The adapter constructs the next request from its validated
+locator and page number. The reported default is first and selected; remaining
+branches use `String.compareTo`. An empty catalog is displayed and cannot
+Browse in branch mode.
 
 The normal ref control is a searchable branch-only chooser. A localized
 advanced action exposes the retained manual branch/tag/commit field, including

docs/specifications/App/specs.md

@@ -347,9 +347,13 @@ adds the novice ref-selection path without weakening A33-SUB-AC-1..10:
   catalog or none: at most 512 names, six pages, 512 KiB per branch page, and
   2 MiB across branch-page bodies. A 513th name, further next page, duplicate
   or invalid name, malformed metadata/page/link, or exceeded byte bound MUST
-  return a localized typed failure. Pagination links MUST be validated for the
-  exact HTTPS API host, repository path, page, and page size but MUST NOT be
-  followed directly; the client constructs the next exact-host request. MUST
+  return a localized typed failure. Metadata MUST provide the positive numeric
+  repository identity used to bind GitHub's canonical
+  `/repositories/{id}/branches` pagination path. Pagination links MUST be
+  validated for the exact HTTPS API host, either that identity-bound path or
+  the locator-derived repository branch path, the next consecutive page, and
+  the fixed page size, but MUST NOT be followed directly; the client constructs
+  the next exact-host request from local values. MUST
 - **A33-BRANCH-AC-4 (state, rate, and accessibility)** — Branch loading MUST
   be a distinct visible/cancellable state. Editing the repository clears the
   catalog and all dependent pinned/navigation/selection/review state without