docs: document vendored namespace policy

AI.md

@@ -448,6 +448,21 @@ Current root/superbuild direction implemented or in progress:
 - FLAIM is currently only needed when the directory service is enabled.  The root
   CMake should therefore add/build `third_party/flaim` only when
   `ENABLE_DIRECTORY=ON`.
+- Namespace rule: keep historical mars-nwe binaries with their established names
+  (`nwserv`, `ncpserv`, `nwclient`, `dbmtool`, `ftrustee`, etc.), but give
+  vendored libraries, vendored headers, CMake packages, and imported helper tools
+  an `nw` namespace when they could collide with system packages or upstream tool
+  names.
+- Current library namespace examples: `libnwowfat`, `libnwsodium`,
+  `libnwmatrixssl`, `libnwflaimtk`, `libnwflaim`, `libnwflaimsql`,
+  `libnwxflaim`, `libnwcore`, `libnwssl`, and `libnwdirectory`.
+- Current header namespace examples: `include/nwlibowfat/`, `include/nwsodium/`,
+  `include/nwmatrixssl/`, `include/nwflaim/`, `include/nwssl/`,
+  `include/nwcore/`, and `include/nwdirectory/`.
+- TinyLDAP/directory tools and FLAIM/XFLAIM tools should install with `nw`
+  prefixes (`nwt2`, `nwparse`, `nwldapclient`, `nwx`, `nwflmcheckdb`,
+  `nwxflmdbshell`, etc.) because their upstream names are generic or
+  collision-prone.
 
 Current `libnwssl` / MatrixSSL / OpenSSL-compat direction:
 

REDESIGN.md

@@ -1614,6 +1614,32 @@ Current local dependency-test policy:
   but mars-nwe should link to the system PAM library rather than vendoring PAM.
 - These local builds are test dependencies, not new third-party submodules.
 
+Current namespace / collision-avoidance policy:
+
+- The `nw` prefix is used for vendored upstream components and imported helper
+  tools that could collide with system packages, not as a blanket rename of every
+  historical mars-nwe executable.
+- Historical mars-nwe programs keep their established names: `nwserv`,
+  `ncpserv`, `nwclient`, `dbmtool`, `ftrustee`, and related original server/client
+  commands are not renamed just for symmetry.
+- Vendored libraries that replace or embed upstream projects use mars-nwe names:
+  `libnwowfat`, `libnwsodium`, `libnwmatrixssl`, `libnwflaimtk`,
+  `libnwflaim`, `libnwflaimsql`, `libnwxflaim`, `libnwcore`, `libnwssl`, and
+  `libnwdirectory`.  The name records that mars-nwe is intentionally using its
+  pinned/imported version rather than any system `libowfat`, `libsodium`,
+  `matrixssl`, `flaim`, or similar package.
+- Vendored headers are likewise installed below `nw...` include namespaces:
+  `nwlibowfat`, `nwsodium`, `nwmatrixssl`, `nwflaim`, `nwssl`, `nwcore`, and
+  `nwdirectory`.
+- Imported tools from TinyLDAP and FLAIM/XFLAIM must use `nw`-prefixed installed
+  names because their upstream names are generic or likely to collide.  Examples
+  include `nwt2`, `nwparse`, `nwldapclient`, `nwasn1dump`, `nwx`,
+  `nwflmcheckdb`, `nwflmview`, `nwxflmcheckdb`, and `nwxflmdbshell`.
+- Compatibility headers owned by `libnwssl` stay inside the `nwssl` namespace,
+  for example `include/nwssl/openssl/*.h` and
+  `include/nwssl/private/nici/...`.  Do not install a top-level
+  `include/openssl/` directory from mars-nwe.
+
 ### libowfat dependency rule
 
 `libowfat` should be a hard bundled dependency, initially for the

TODO.md

@@ -2071,14 +2071,41 @@ Follow-up:
 
 #### Third-party renamed library/import hygiene
 
-- Keep FLAIM, MatrixSSL, and libowfat imports recognizable as third-party code.
-  Local changes should be build, CMake, portability, naming, or very small
-  documented compatibility fixes only.
-- Add `include/nwssl/private/nici.h` and the minimal
-  `include/nwssl/private/openssl/*.h` headers when implementing the FLAIM build,
-  then wire those paths privately into `libnwflaimtk`/`libnwflaim`.
+Current status:
+
+- The mars-nwe superbuild now follows a deliberate namespace policy rather than
+  renaming every installed program blindly.  Historical mars-nwe executables keep
+  their long-standing names (`nwserv`, `ncpserv`, `nwclient`, `dbmtool`,
+  `ftrustee`, etc.).
+- Vendored or otherwise replaceable libraries are renamed with an `nw` prefix
+  because system installations may provide libraries with the upstream names.
+  Current examples are `libnwowfat`, `libnwsodium`, `libnwmatrixssl`,
+  `libnwflaimtk`, `libnwflaim`, `libnwflaimsql`, `libnwxflaim`,
+  `libnwcore`, `libnwssl`, and `libnwdirectory`.
+- Vendored public headers are installed below mars-nwe namespace directories,
+  such as `include/nwlibowfat/`, `include/nwsodium/`,
+  `include/nwmatrixssl/`, `include/nwflaim/`, `include/nwssl/`,
+  `include/nwcore/`, and `include/nwdirectory/`.
+- New or imported helper tools that would otherwise have generic upstream names
+  are installed with an `nw` prefix.  This includes the TinyLDAP/directory tools
+  (`nwt2`, `nwparse`, `nwldapclient`, `nwasn1dump`, `nwx`, etc.) and the
+  FLAIM/XFLAIM utilities (`nwflmcheckdb`, `nwflmrebuild`, `nwxflmcheckdb`,
+  `nwxflmdbshell`, etc.).
+- `libnwssl` owns the installed OpenSSL-compat and NICI/CCS compatibility header
+  layout.  The compat headers live under `include/nwssl/openssl/*.h` and
+  `include/nwssl/private/nici/...`, not beside `nwssl` and not under a global
+  `include/openssl/` directory.
+
+Follow-up:
+
+- Keep FLAIM, MatrixSSL, libowfat, libsodium, yyjson, and other imports
+  recognizable as third-party code.  Local changes should be build, CMake,
+  portability, naming, or very small documented compatibility fixes only.
+- Keep the `nw` namespace rule tied to collision avoidance and vendored-version
+  control.  Do not rename historical mars-nwe server/client binaries merely for
+  symmetry when their names are already project-specific or established.
 - Do not install or advertise `nwssl/private/*` as public API.  Normal consumers
   use public `libnwssl` headers.
-- The libowfat import should expose the planned renamed shared library artifact
-  `libnwowfat` while documenting the underlying upstream source/version as
-  libowfat.
+- When adding another imported library/tool, decide explicitly whether it is a
+  system-collision risk.  If yes, give the library, headers, CMake package, and
+  imported tools an `nw` namespace from the first patch.