fix(lint): MD037 emphasis-marker false-positive on T9.006*

CI markdownlint flagged `T9.006*` as a malformed italic-emphasis marker (markdown parsers see ` * ` patterns as emphasis-open with whitespace). Replace `T9.006*` with `T9.006.x` (semantic equivalent — the .x denotes the sub-Technique family) in tactics/T17-market-manipulation.md and VERSIONING.md.

Signed-off-by: Dmytro Chystiakov <dlchistyakov@gmail.com>

Author: iZonex

VERSIONING.md

@@ -86,7 +86,7 @@ When an item must be renamed or removed, OAK provides a deprecation window of on
 | 0.1 | 2026-04 | Initial public draft. 14 Tactics, 62 Techniques, 18 Threat Actors, 40 Mitigations, 40 Software, 12 Data Sources. |
 | 0.2 | 2026-05 | Additive: T15 Off-chain Entry-Vector / Pre-Positioning Tactic + 5 sub-Techniques (T15.001–T15.005). 15 Tactics, 63+ Techniques. Existing T1–T14 IDs unchanged; existing T11.x / T4.x worked-example mappings preserved. Schema-minor bump per the additive-Tactic rule. |
 | 0.3 | 2026-05 | Additive: T16 Governance / Voting Manipulation Tactic + 5 sub-Techniques (T16.001–T16.005). 16 Tactics, 93+ Techniques. Existing T9.003 / T9.001 / T8.001 / T5.005 / T9.002 mappings preserved on anchor examples; T16.x added as additional Technique mappings. |
-| 0.4 | 2026-05 | Additive: T17 Market Manipulation Tactic + 4 sub-Techniques (T17.001–T17.004). 17 Tactics. T3.002 / T3.003 / T3.004 / T5.004 / T9.001 / T9.006* now cross-reference T17 as additional parent. No existing IDs renamed; existing T3 / T5 / T9 parent-Tactic mappings preserved on every cross-referenced sub-Technique. |
+| 0.4 | 2026-05 | Additive: T17 Market Manipulation Tactic + 4 sub-Techniques (T17.001–T17.004). 17 Tactics. T3.002 / T3.003 / T3.004 / T5.004 / T9.001 / T9.006.x now cross-reference T17 as additional parent. No existing IDs renamed; existing T3 / T5 / T9 parent-Tactic mappings preserved on every cross-referenced sub-Technique. |
 | 0.5 | 2026-05 | Additive cheap fixes from `TAXONOMY-AUDIT.md`. T11.004 (Insufficient-Entropy Key Generation) backfilled, anchored at Wintermute / Profanity (Sep 2022). Maturity vocabulary widened from four to five canonical values (`stable` / `emerging` / `observed` / `draft` / `deprecated`) — `observed` and `developing` files normalised to the canonical set. Tactic `**Phase:**` field canonicalised to a six-value vocabulary (Pre-positioning / Pre-launch-Launch / Targeted compromise / Realization / Post-extraction / Cross-cutting); documented at `tactics/README.md`. Optional `**Parent Techniques:**` and `**Adjacent Techniques:**` fields documented at `tactics/README.md` and `CONTRIBUTING.md`; applied to T11.001 / T11.002 / T10.001 / T9.003 / T7.004 / T12.001. T9.003 scope refined to governance-contract-bug case (T16.x covers voting-power abuse). T11.001 scope refined to on-chain manifestation (off-chain pre-positioning delegated to T15.x). T8 human-readable name updated to "Operator Continuity / Attribution Signals" (ID `OAK-T8` unchanged). T6 sub-cluster split (T6.001–004 pre-deployment-claim-falsification vs T6.005–007 operational-defense-evasion) documented. No OAK ID renamed. 17 Tactics, 94 Techniques. |
 
 ## Content snapshot history

tactics/T17-market-manipulation.md

@@ -11,7 +11,7 @@ T17 is intentionally distinct from **T3 (Holder Capture)**. T3 sub-Techniques T3
 
 T17 is intentionally distinct from **T5 (Value Extraction)**. T5 covers direct on-chain value-egress patterns — treasury sweep (T5.005), exit-scam liquidity removal (T5.001), router / approval drainer (T5.002), permit-signature drain (T5.003), sandwich / MEV (T5.004), vesting-cliff dump (T5.006). T17 is *market-distortion-mediated* extraction: the value flows because price discovery, order-book state, or window timing was shaped into a configuration that the protocol's accounting then settled against. T5.004 (Sandwich / MEV Extraction) is a boundary case because MEV extraction is *itself* a market-manipulation primitive at the per-block / per-transaction level — T5.004 is dual-mapped under T5 (the on-chain extraction framing) and T17 (the market-manipulation framing) without rename.
 
-T17 is intentionally distinct from **T9 (Smart-Contract Exploit)**. T9.001 (Oracle Price Manipulation) and T9.006 / T9.006.001-004 (Subjective-Oracle Resolution Manipulation) sub-Techniques cover the *code-mechanism* failure modes where the oracle / resolution surface is the load-bearing exploitable contract surface. T17 is the *market-mechanism* framing of the same incident class: the oracle behaved as specified, but the attacker shaped market state into a configuration that the oracle reported faithfully and the protocol accounted against. T9.001 / T9.006* mappings on existing worked examples are preserved; T17 is added as an additional parent for the post-launch market-manipulation framing of these incidents.
+T17 is intentionally distinct from **T9 (Smart-Contract Exploit)**. T9.001 (Oracle Price Manipulation) and T9.006 / T9.006.001-004 (Subjective-Oracle Resolution Manipulation) sub-Techniques cover the *code-mechanism* failure modes where the oracle / resolution surface is the load-bearing exploitable contract surface. T17 is the *market-mechanism* framing of the same incident class: the oracle behaved as specified, but the attacker shaped market state into a configuration that the oracle reported faithfully and the protocol accounted against. T9.001 / T9.006.x mappings on existing worked examples are preserved; T17 is added as an additional parent for the post-launch market-manipulation framing of these incidents.
 
 T17 is intentionally distinct from **T16 (Governance / Voting Manipulation)**. T16's load-bearing surface is voting power converted into a protocol decision. T17's load-bearing surface is price / order-book / oracle-window state converted into a market-mediated value flow. The kill-chains can compose — Mango Markets October 2022 reads as T9.001 (oracle manipulation as the code-mechanism layer) → T17 / T17.x (market-manipulation framing as the cross-cutting Tactic) → T16.002 (hostile-vote treasury drain) → T5.005 (treasury egress) — but the Tactic boundaries partition cleanly by which surface the attacker is acting on at each step.
 
@@ -26,7 +26,7 @@ T17 sits in the kill-chain in **parallel** with T5 (both are realisation-phase T
 - **Wash-trade-credibility cohorts (T17 ↔ T3.002):** post-launch wash-trade volume to maintain CEX-listing eligibility, exchange-incentive farming, or analytics-platform ranking; the cohort attribution is funder-graph clustering at the wash-trader account level.
 - **Pump-and-dump coordination cohorts (T17 ↔ T3.003 / T3.004):** Telegram-channel-coordinated or influencer-amplified post-launch pump-and-dump events; OAK does not classify Telegram-cohort PnD as launch-time-only; the same pattern fires repeatedly on illiquid mid-cap altcoins through a token's lifetime.
 - **Sandwich / MEV (T17 ↔ T5.004):** per-block MEV extraction that is *itself* a market-manipulation primitive against the victim swap; T5.004's existing observed-indicator set carries over.
-- **Oracle-mediated market manipulation (T17 ↔ T9.001 / T9.006*):** the existing T9.001 and T9.006* defender signal sets carry over; T17 frames the same incidents at the market-manipulation Tactic level rather than at the oracle-code-mechanism Tactic level.
+- **Oracle-mediated market manipulation (T17 ↔ T9.001 / T9.006.x):** the existing T9.001 and T9.006.x defender signal sets carry over; T17 frames the same incidents at the market-manipulation Tactic level rather than at the oracle-code-mechanism Tactic level.
 
 ## Relationship to other tactics
 
@@ -76,7 +76,7 @@ The core editorial question this Tactic answers: **why introduce T17 as a cross-
 
 The answer is structural. v0.1 OAK distributed market-manipulation patterns across three Tactics by *contextual phase* (T3 = launch-time, T5 = on-chain extraction, T9 = code-mechanism), which kept each individual Technique page coherent against its Tactic's primary framing but made the *cross-cutting market-manipulation pattern* invisible at Tactic-level. A defender asking "what does the OAK corpus say about market manipulation?" at v0.3 had to look in three different Tactics and reconstruct the cross-cutting class manually. A defender asking "is this pattern wash-trading or pump-and-dump or sandwich-MEV or oracle manipulation?" had to pick one Tactic per case rather than acknowledge that several mid-life market-manipulation incidents legitimately span multiple Tactics simultaneously (a wash-trade cohort that becomes a pump-and-dump that ends with sandwich-MEV against the dumping wallet's victims is a single operational behaviour with a single attacker cluster).
 
-T17 makes the cross-cutting class legible **without renaming any existing OAK ID**. The existing T3.002 / T3.003 / T3.004 / T5.004 / T9.001 / T9.006* sub-Technique pages remain in place at their primary Tactic homes; T17 is added as an *additional* parent on each. This is a schema-minor additive change per VERSIONING.md: downstream consumers pinned to v0.3 continue to resolve every existing ID under its existing primary Tactic; consumers consuming v0.4-and-later see the additional T17 parent edge.
+T17 makes the cross-cutting class legible **without renaming any existing OAK ID**. The existing T3.002 / T3.003 / T3.004 / T5.004 / T9.001 / T9.006.x sub-Technique pages remain in place at their primary Tactic homes; T17 is added as an *additional* parent on each. This is a schema-minor additive change per VERSIONING.md: downstream consumers pinned to v0.3 continue to resolve every existing ID under its existing primary Tactic; consumers consuming v0.4-and-later see the additional T17 parent edge.
 
 The 4 new T17.x sub-Techniques cover market-manipulation patterns that v0.1 OAK did not have a Technique-level home for at all:
 
@@ -91,13 +91,13 @@ Maturity boundary at introduction: T17.002 is `emerging` (anchored against exist
 
 ## Maintainer notes
 
-T17 is the OAK editorial response to the v0.3 TAXONOMY-AUDIT observation that market-manipulation patterns were the largest single un-Tactic'd cross-cutting cohort in the corpus. T3.002 / T3.003 / T3.004 / T5.004 / T9.001 / T9.006* collectively span ~$300M+ in realised loss across multiple distinct operational sub-patterns that the v0.3 schema could only enumerate as primary-parented sub-Techniques inside their respective Tactic homes. Adding T17 as a cross-cutting Tactic with cross-references-not-renames makes the cross-cutting class legible at Tactic-level without breaking the existing schema.
+T17 is the OAK editorial response to the v0.3 TAXONOMY-AUDIT observation that market-manipulation patterns were the largest single un-Tactic'd cross-cutting cohort in the corpus. T3.002 / T3.003 / T3.004 / T5.004 / T9.001 / T9.006.x collectively span ~$300M+ in realised loss across multiple distinct operational sub-patterns that the v0.3 schema could only enumerate as primary-parented sub-Techniques inside their respective Tactic homes. Adding T17 as a cross-cutting Tactic with cross-references-not-renames makes the cross-cutting class legible at Tactic-level without breaking the existing schema.
 
-Per `VERSIONING.md`, adding T17 is an additive schema change (schema-minor bump, 0.3 → 0.4): existing T1-T16 IDs are unchanged, and existing T3.002 / T3.003 / T3.004 / T5.004 / T9.001 / T9.006* parent-Tactic mappings are preserved. Anchor worked examples carry both the existing primary Tactic mapping AND the new T17 cross-reference, so downstream consumers pinned to the v0.3 schema continue to resolve the existing IDs without breakage.
+Per `VERSIONING.md`, adding T17 is an additive schema change (schema-minor bump, 0.3 → 0.4): existing T1-T16 IDs are unchanged, and existing T3.002 / T3.003 / T3.004 / T5.004 / T9.001 / T9.006.x parent-Tactic mappings are preserved. Anchor worked examples carry both the existing primary Tactic mapping AND the new T17 cross-reference, so downstream consumers pinned to the v0.3 schema continue to resolve the existing IDs without breakage.
 
 Future T17 contributions should preserve four boundary rules:
 
 - **Market-mechanism state is the load-bearing surface.** If the attack does not go through a price / order-book / window / cross-venue-spread primitive, it is not T17. Code-bug exploitation is T9; voting-power-against-protocol is T16; direct treasury / approval / routing pulls are T5; launch-time holder-state concentration is T3.
 - **No contract bug required.** T17's load-bearing distinction from T9 is that the protocol behaves *as designed*. If the exploit requires a code defect (reentrancy, missing access check, integer overflow), it is T9.
-- **Existing primary Tactic mappings preserved.** Every T3.002 / T3.003 / T3.004 / T5.004 / T9.001 / T9.006* worked example keeps its existing T3 / T5 / T9 mapping. T17 is added; existing Tactic mappings are never removed in favour of T17.
+- **Existing primary Tactic mappings preserved.** Every T3.002 / T3.003 / T3.004 / T5.004 / T9.001 / T9.006.x worked example keeps its existing T3 / T5 / T9 mapping. T17 is added; existing Tactic mappings are never removed in favour of T17.
 - **Cross-cutting Tactic, not replacement.** T17 is parent-to-many; the cross-referenced sub-Techniques retain their primary Tactic identity. T17 sub-Techniques (T17.001-004) are sub-Techniques of T17 only and do not parent to T3 / T5 / T9 unless a future schema-major bump migrates them.