docs(adr): ADR-0135's two prose citations of the code name what the code now says (#18344)

Fixes #14361

Third and final segment. Segments 1 and 2 (PR #18228, last commit
`0f95f4341`) handled the 152 citations under `packages/**` and
`content/docs`. This segment is the remainder: every unqualified
`ADR-0024` under `docs/adr/`.

Clause-②: no

## The instrument is wrong in both directions

The dispatch handed me a population of **21 bare lines in 7 files**,
measured as "lines matching `ADR-0024`, minus lines containing `cloud
ADR-0024`". I reproduced that 21 exactly. Then I re-measured per
**occurrence** instead of per **line**:

| instrument | count |
|:--|--:|
| `ADR-0024` occurrences under `docs/adr/` | 35 |
| lines matching, minus lines containing `cloud ADR-0024` | 21 |
| occurrences whose preceding token is not `cloud` (backticks allowed) |
**18** |

- **4 false positives.** ADR-0135 lines 3, 31, 232, 271 spell the
qualifier with backticks in the middle — `` `objectstack-ai/cloud`
ADR-0024 `` and `` `cloud` ADR-0024 ``. The literal-string filter does
not see the qualifier. They are qualified and correct.
- **1 false negative.** ADR-0135 line 248 begins `` `ADR-0024 V1` `` and
*also* contains `` `cloud ADR-0024` `` later in the same line, so `grep
-v` discarded the whole line — hiding a bare citation. It is one of the
two defects below.

`21 − 4 + 1 = 18`. A third artifact is invisible to any line filter:
ADR-0135 line 79 begins `ADR-0024 chose the other direction`, and its
qualifier `cloud` is the last word of line 78. Line-wrapped, therefore
qualified.

Controls for every zero reported here are in the dev report.

## Verdicts — 18 occurrences, each checked against the other end

The D-letter test that segments 1 and 2 used has **zero** resolving
power here (0 of 18 carry a `D` clause letter), so every row is a read
of the cited record.

### Local `docs/adr/0024-mcp-connectors.md` — 10 sites, all correct

| site | claim made | other end | verdict |
|:--|:--|:--|:--|
| `0023-openapi-to-connector-generator.md:148` | "the complementary path
— wrapping live MCP servers as connectors" | explicit link
`./0024-mcp-connectors.md`; title is *MCP Servers as Connectors* |
correct |
| `0024-mcp-connectors.md:1` | the record's own H1 | self | correct |
| `0025-plugin-package-distribution.md:7` | Related list, labelled
"(connectors)" | explicit link | correct |
| `0025-plugin-package-distribution.md:395` | "ADR-0024 (MCP
connectors), any integration describable by OpenAPI/MCP is a declarative
connector config" | ADR-0024 TL;DR: one adapter, "no per-server code" |
correct |
| `0025-plugin-package-distribution.md:529` | Related list | explicit
link | correct |
| `0036-app-as-rest-api-and-mcp-server.md:5` | "MCP as connectors — the
*inbound* sibling: ObjectStack **consuming** external MCP servers" |
ADR-0024 section 1 ships `@objectstack/connector-mcp`, an adapter that
connects *to* MCP servers — inbound | correct |
| `0097-declarative-connector-instances.md:5` | Builds-on, "(MCP servers
as connectors)" | explicit link | correct |
| `0097-declarative-connector-instances.md:199` | "sandboxed execution
remains the enterprise tier (ADR-0024 §4)" | ADR-0024 `### 4.` tier
table, enterprise row, reads "sandboxed stdio execution" | correct —
exact |
| `0097-declarative-connector-instances.md:205` | "MCP credentials ride
the transport (ADR-0024)" | ADR-0024 `### 3.` "Credentials and config
live with the MCP server… transport `env`/`headers` carry credentials" |
correct — exact |
| `0101-mcp-stdio-principal-admission.md:5` | "ADR-0024 §4 (trust
model)" | `### 4.` is the open/enterprise boundary carrying the trust
assumption | correct |

The two section citations are also structurally disambiguating: the
local record numbers its sections `### 1.` … `### 5.`, while cloud
ADR-0024 letters its clauses `D1…D10`/`V1`. A `§4` cannot be a cloud
clause.

### `docs/adr/0135-identity-and-access-architecture.md` — 8 sites, 6
correct, 2 fixed

| line | text | kind | other end | verdict |
|:--|:--|:--|:--|:--|
| 54 | "A bare `ADR-0024` in this repository's code does NOT resolve to
this record" | **mention** | `0024-mcp-connectors.md` exists and is
unrelated; `0071` here is *Dataset semantic-layer depth* as the same
sentence claims | correct — adding `cloud` inverts it |
| 63 | `git grep -n -E "ADR-0024" -- packages/…` | **literal** | re-ran
the command verbatim: 14 lines, 0 unqualified. The sentence is
explicitly scoped "on the commit that introduced it… measured 64", so it
is historical and still true | correct — editing it breaks the command |
| 79 | `ADR-0024 chose the other direction` | **use** | `cloud` is the
last word of line 78 | correct — line-wrap artifact |
| **196** | "the clause this repository's code cites as `ADR-0024 ②`" |
**mention** | the live source cites `ADR-0135 D6` — `auth-manager.ts`
2793/3667/6654, `auth-plugin.ts` 2796, `register-sso-provider.ts` 316,
`auth-route-ledger.ts` 238–239. `ADR-0024 ②` survives only in CHANGELOGs
| **fixed** |
| 246 | "a bare `ADR-0024` citation in this tree is not mechanically
re-pointable" | **mention** | — | correct |
| **248** | "`auth-manager.ts` cites `ADR-0024 V1`" | **mention** |
`auth-manager.ts:3661` reads `cloud ADR-0024 V1` | **fixed** |
| 260 | "Whether any individual bare `ADR-0024` citation should move" |
**mention** | — | correct |
| 265 | "A reader who follows an `ADR-0024` citation out of
`plugin-auth`" | **mention** | — | correct |

## The two fixes

Both are present-tense descriptions of **what this repository's code
says**. Both were true when the record was written and were made false
by segments 1 and 2 of this same card.

**Line 196.** Under either reading the line was wrong. Read as a
quotation of the code, it quotes a string the live source no longer
contains. Read as naming the cloud clause, it is a bare cloud citation,
which Prime Directive #13 forbids and which resolves against *this*
registry to `0024-mcp-connectors.md` — a record numbered 1–5 with no
clause ②. The fix names the cloud clause *and* the spelling the code now
uses, so both readings land.

**Line 248.** A one-token insert. The same sentence already prescribes
"those keep the `cloud ADR-0024` spelling"; `auth-manager.ts` now does,
and the quotation did not.

Everything else is untouched. No citation that was already correct was
moved.

## Left alone, deliberately

ADR-0135's Consequences bullet (line 265 ff.) reads "**Until then** the
citation still resolves to `docs/adr/0024-mcp-connectors.md`". Its
antecedent has now passed: the verbatim grep on line 63 returns 0
unqualified citations in `plugin-auth/src` and
`platform-objects/src/identity`. The **citation** on that line is a
correct mention, so it is not a defect of the kind this card is about;
the surrounding tense is merely spent, and rewriting a mirror record's
Consequences prose is a maintainer's call, not a per-site citation call.
Flagged rather than edited — say the word and it moves in this PR.

## 维护者速读(草稿)

**改了什么** —— `docs/adr/0135-identity-and-access-architecture.md`
两处散文里对「本仓代码怎么引用」的描述,改成代码现在真正写的样子。共 7 增 6 删,只动这一个文件。

**为什么改** —— 这两句话在写下时是真的,是 #14361 前两段自己把它们变假的。196 行说域名验证子句「本仓代码引作
`ADR-0024 ②`」,而活代码七处已经引 `ADR-0135 D6`,`ADR-0024 ②` 只剩在 CHANGELOG
里;它同时还是一个裸的 cloud 引用,按 Prime Directive #13 会解析到本仓的
`0024-mcp-connectors.md`,而那份记录分节是 1–5,根本没有子句 ②。248 行把 `auth-manager.ts`
引述成 `ADR-0024 V1`,文件里写的是 `cloud ADR-0024 V1` —— 恰是同一句话下半段要求保留的拼写。

**风险与代价(含回滚)** —— 纯散文,零代码、零发布物。`docs/adr/**` 不在任何包的 `files[]` 里(70 个声明了
`files[]` 的包全部为 0 命中),所以无 changeset。回滚 = revert 这一个
commit,没有任何下游。唯一的判断风险是 196 行的改写:它比 248 行多改了几个字,如果您认为镜像记录应当只记 cloud
的字母而不提本仓代码今天的拼写,把它退回成 `` `cloud ADR-0024` 的子句 ② `` 即可,一行的事。

**席位意见** ——

**你要做的** —— 这是治理面,需要您手工批准并合并;席位不入队、不武装 auto-merge。请特别看一眼「Left alone,
deliberately」那一节:ADR-0135 Consequences 里的 "Until then"
已经过期,我没有动它,因为改镜像记录的 Consequences 散文不该由 dev 自己决定。您说改我就在本 PR 里改。

## Acceptance notes

- `docs/adr/**` is a governed surface. Draft, maintainer-merged. Not
queued, auto-merge not armed.
- **Changeset: skipped, measured.** 70 workspace packages declare
`files[]`; 0 of them ship any `docs`/`adr` path, and `docs/` contains no
`package.json`, so `docs/adr/**` is not inside a workspace package at
all. Fire control on the same scan: all 70 ship a `dist` entry. Nothing
published moves.
- Population after this PR: 35 occurrences, 19 qualified, 16 unqualified
— all 16 verdicted correct above.
- `noted, not filed:` the "Until then" tense in ADR-0135's Consequences,
above. Carrier named: this PR's reviewer.
- `noted, not filed:` the line-based `grep -v 'cloud ADR-0024'` recipe
is quoted inside ADR-0135 line 63 itself and mis-bins 5 of 21 sites. It
is correct *as written there* (that sentence counts citing lines at a
past commit), so there is nothing to fix; but anyone reusing that recipe
as a population filter will inherit the same 4 false positives and 1
false negative. Carrier: none — no open PR or queued card reuses it.

## Verification

All 19 gate families derived by `scripts/pm/dispatch-gates.mjs
--commands --repo objectstack-ai/objectstack` (which takes the change
set from the merge base itself) are green at `c4d13026b`.
`check:doc-formula-expressions` first exited **3 — PREREQUISITE NOT
MET**, which is not a finding; after `turbo run build
--filter=@objectstack/formula --filter=@objectstack/lint` it exits 0.

`pnpm lint` is not owed and is not narrowed — it is **not measured
because the population is empty**. eslint's own verdict on the only file
in this diff is `File ignored because no matching configuration was
supplied`, `eslint.config.mjs` contains no markdown entry, and line 328
of that config records that no `parserOptions.project` and no typed
rules are enabled, so this diff cannot move any untouched file's
verdict.

---

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_017ef78bLdybu3AffehKkhfk

---
_Generated by [Claude
Code](https://claude.ai/code/session_017ef78bLdybu3AffehKkhfk)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-try-charles

docs/adr/0135-identity-and-access-architecture.md

@@ -193,11 +193,12 @@ and secret handling run: `packages/plugins/plugin-auth/src/register-sso-provider
 model bridged at the adapter layer (`packages/plugins/plugin-auth/src/auth-schema-config.ts`
 records why the bridge sits there and not on the plugin's `schema` option).
 
-**Domain verification is opt-in** — the clause this repository's code cites as `ADR-0024 ②`. When
-the environment turns it on, `@better-auth/sso` mounts a DNS-TXT proof-of-ownership challenge and
-refuses a login through a provider whose email domain is not proven, which stops an organization
-admin from registering a provider for a domain they do not control. It is off by default, because
-turning it on changes the register-then-login flow. The surface is
+**Domain verification is opt-in** — `cloud ADR-0024`'s clause ②, which this repository's code now
+cites as `ADR-0135 D6`. When the environment turns it on, `@better-auth/sso` mounts a DNS-TXT
+proof-of-ownership challenge and refuses a login through a provider whose email domain is not
+proven, which stops an organization admin from registering a provider for a domain they do not
+control. It is off by default, because turning it on changes the register-then-login flow. The
+surface is
 `packages/platform-objects/src/identity/sys-sso-provider.object.ts#request_domain_verification`,
 `#verify_domain` and `#domain_verified`.
 
@@ -245,7 +246,7 @@ this repository that means one of them must keep citing `cloud ADR-0024`:
 ⚠️ Consequence for [#14361](https://github.com/objectstack-ai/objectstack/issues/14361): a bare
 `ADR-0024` citation in this tree is **not** mechanically re-pointable at this record. Some of
 today's citations mean a clause above — `packages/plugins/plugin-auth/src/auth-manager.ts` cites
-`ADR-0024 V1` for the SSO default-role provisioning — and those keep the `cloud ADR-0024`
+`cloud ADR-0024 V1` for the SSO default-role provisioning — and those keep the `cloud ADR-0024`
 spelling. The re-pointing is per-site and semantic.
 
 ## What this record does NOT settle