[WIP] Add Chinese version of the documentation - #13

…objectstack-ai#3723 follow-up) (objectstack-ai#4575)

An accepted ADR is only binding if the code it binds points back at it.

objectstack-ai#3723 is the proof. Three accepted ADRs said the same thing — ADR-0057 D4
("never as the authority for RBAC"), ADR-0090 D3's word ban ("distribution =
position"), ADR-0095 D3 ("no enforcement-time code path may consult the
better-auth role") — and a patch-level changeset reversed all three by making
app-declared names storable in `sys_member.role`. A follow-up then made the
derivation automatic in every host. The reversal held for a day; the tracking
issue was closed, reopened and rewritten three times while the cause moved.

The mechanism was not carelessness. `auth-manager.ts` cited ADR-0105 D8 (why
`delegated_admin` is registered) and said nothing about why the app-role loop
beside it was a violation. Reading that file, an author — human or agent —
could not have known. In a repo worked by many agents in parallel, nobody
greps the ADR corpus before an edit; the constraint has to be where the edit is.

So: a curated map of file → governing ADR ids + the invariant, and a check that
the ids still appear in the file. Deliberately dumb — it is a presence check,
not a proof of obedience (no static check can be that). Its value is the
failure text, which states the INVARIANT rather than "put this string back",
and that it fires on exactly the diff worth a second look: someone rewriting a
governed block and dropping the rationale with it.

Seeded with 8 anchors, all in the incident's blast radius: the membership-role
cluster (spec, auth-manager, auth-plugin, both platform objects), the authz
resolver, the delegated-admin gate, the invitation role cap. Deliberately not
more — a map of everything is a map of nothing, and each entry must earn its
failure mode.

Also AGENTS.md Prime Directive objectstack-ai#13: reversing a recorded decision is itself a
decision and needs a superseding ADR, not a changeset that quietly does the
opposite; and when you implement an ADR, leave its id in the code.

Verified by temporarily stripping `ADR-0108` from auth-manager.ts (fails, with
the invariant), plus the missing-file, withdrawn-ADR (0107) and malformed-id
paths.


Claude-Session: https://claude.ai/code/session_0186LhwkUBupmLJUUAMda5hU

Co-authored-by: Claude <noreply@anthropic.com>

…at two comment sites

Two comments in `packages/metadata-protocol` cite `ADR-0094 D3` for boot
reconciliation. In ADR-0094 that is D4 (`### D4 — Boot reconciliation and the
migration/backfill path`); D3 is a different decision — `### D3 — Data-door
writes are redirected into metadata (write-through)`.

Prime Directive #13's mechanism is that a code comment naming an ADR section
sends the next author to the decision they are standing on. A wrong section
sends them to the write-through redirect table when they were looking for the
`kernel:ready` convergence pass — a plausible-looking wrong answer, which is
worse than no citation at all.

Comment text only; no behaviour, no assertion, no test semantics. The edit is
byte-length neutral, so no line number moves.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ARYe3yQTQCUFm5qPYNgKaJ

The landing that killed the old premise has a decision record; name it
where the premise is restated, per Prime Directive #13.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8

…at two comment sites (objectstack-ai#16153)

Two comments in `packages/metadata-protocol` cite `ADR-0094 D3` for boot
reconciliation. In ADR-0094 that is D4 (`### D4 — Boot reconciliation and the
migration/backfill path`); D3 is a different decision — `### D3 — Data-door
writes are redirected into metadata (write-through)`.

Prime Directive objectstack-ai#13's mechanism is that a code comment naming an ADR section
sends the next author to the decision they are standing on. A wrong section
sends them to the write-through redirect table when they were looking for the
`kernel:ready` convergence pass — a plausible-looking wrong answer, which is
worse than no citation at all.

Comment text only; no behaviour, no assertion, no test semantics. The edit is
byte-length neutral, so no line number moves.


Claude-Session: https://claude.ai/code/session_01ARYe3yQTQCUFm5qPYNgKaJ

Co-authored-by: Claude <noreply@anthropic.com>

…orkspace can never supply (objectstack-ai#16907)

* test(dogfood): make the enterprise-organizations control hermetic (objectstack-ai#16539)

WIP: fixture-only subject + premise legs. Verification pending.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8

* test(dogfood): cite ADR-0132 beside objectstack-ai#16215 in the rewritten premises

The landing that killed the old premise has a decision record; name it
where the premise is restated, per Prime Directive objectstack-ai#13.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8

---------

Co-authored-by: Claude <noreply@anthropic.com>

…tion, and record the artifact-ingestion door

Two records-only corrections to ADR-0087, both additive — no sentence is
rewritten or deleted, because an accepted ADR's text binds and a superseded
decision is still a record (Prime Directive #13).

1. The "retired entry is skipped by the loader" paragraph under "The
   load-window's second half is now mechanical" states the authoring load
   path's rule and stands 35 lines above the 2026-07-31 addendum that
   supersedes it for metadata at rest. It gains an in-place blockquote pointer
   naming both addenda, in the same form ADR-0044 and ADR-0058 use.

2. The artifact-ingestion door's policy was ruled on #12772 and recorded in no
   addendum: the ADR's reader met the stored-row policy and nothing about the
   boot seam. A ninth addendum records it in the file's own addendum form,
   quoting the ruling verbatim, with the as-built window, the two in-tree
   doors, the default-flip exclusion, the schema-layer residue boundary and
   the flag's live seam inventory.

Claude-Session: https://claude.ai/code/session_01DAcomhvR9kKizeYgg89Vo8
Co-authored-by: Claude <noreply@anthropic.com>

…s the burn-rate window

Contract review on PR #18007 ruled that the "Both keep their names" sentence
in `system-metrics-window-durations-unit-in-key`'s acceptanceCriteria must
gain a pointer. That field's contract is "how the consumer proves the
hand-migration correct" — it renders as "Done when:" in the upgrade guide and
"verify:" in `migrate meta` — so a normative sentence saying the burn-rate
window keeps its name does not merely go stale once the key is tombstoned, it
instructs a reviewer that a correct sweep was an error.

Not a rewrite: every existing word is left in place and the clause is
appended, per Prime Directive #13. Nor is it amending published history — the
protocol-18 step is unreleased and still assembling (PROTOCOL_VERSION is
17.0.0, the guide ends at 16 to 17, and both entry ids render nowhere today),
so this finishes the step rather than editing a shipped record.

Claude-Session: https://claude.ai/code/session_015c5G6TmpMKgnusmTpD7Ntt
Co-authored-by: Claude <noreply@anthropic.com>

…ode now says

The mirror record describes, in the present tense, how this repository's code
cites two cloud clauses. Both descriptions were true when the record was written
and are false against the tree today:

- D6 said the domain-verification clause is "the clause this repository's code
  cites as `ADR-0024 ②`". The live source cites `ADR-0135 D6` (auth-manager.ts
  2793/3667/6654, auth-plugin.ts 2796, register-sso-provider.ts 316,
  auth-route-ledger.ts 238-239); `ADR-0024 ②` now survives only in CHANGELOGs.
  The bare form was also a bare cloud citation, which Prime Directive #13 forbids
  and which resolves against this registry to `0024-mcp-connectors.md` — a record
  whose sections are numbered 1-5 and that has no clause ②.

- The #14361 consequence note quoted auth-manager.ts as citing `ADR-0024 V1`.
  That file reads `cloud ADR-0024 V1`, which is the spelling the same sentence
  goes on to prescribe.

Every other unqualified `ADR-0024` under docs/adr is correct and is left alone:
ten are the local MCP-connector record (verified against its own sections 3 and
4), and the rest are mentions of the bare string as a string, a line-wrapped
`cloud ADR-0024`, and a literal grep pattern.

Co-authored-by: Claude <noreply@anthropic.com>