docs: tighten the authoritative boundary and accept ADR-004

[Sandyzzx]

Summary

Follow-up to #34, tightening the boundary between authoritative documents, research material, and now the control/state/observation split.

Root directory emptied of research material

master still carried four research/recommendation/report documents at the repository root. They move under docs/:

Now at	Was
docs/research/task-feedback-v0-1-2026-10-05/ZCODE_APPSERVER_EVENT_CAPABILITY_PROBE.md	ZCODE_APPSERVER_EVENT_CAPABILITY_PROBE.md
docs/research/task-feedback-v0-1-2026-10-05/TASK_FEEDBACK_SCHEMA_RECOMMENDATION.md	TASK_FEEDBACK_SCHEMA_RECOMMENDATION.md
docs/research/task-feedback-v0-1-2026-10-05/NATIVE_FEEDBACK_RENDERER_RECOMMENDATION.md	NATIVE_FEEDBACK_RENDERER_RECOMMENDATION.md
docs/research/task-feedback-v0-1-2026-10-05/evidence/run-001-summary.json	probe/evidence/run-001-summary.json
docs/reports/task-feedback-v0-1-implementation-2026-10-06.md	TASK_FEEDBACK_V01_IMPLEMENTATION_REPORT.md

The root now holds only README.md, README.zh-CN.md, AGENTS.md, CHANGELOG.md, LICENSE, NOTICE and the build/config files.

The three documents stay together in one dated dossier rather than the three separate folders the review suggested: they are a cross-linked set produced for one deliverable, and single-file folders add path depth without a benefit.

Authority headers on every authoritative document

ARCHITECTURE.md, INTERFACES.md, SHARED_CORE.md, ZCODE_RUNTIME.md and docs/README.md now carry the header that previously only PROJECT_STATE.md had. docs/README.md no longer says status is assigned centrally; each file states its own status, and the index only summarises.

Last updated and Last verified are kept separate, and partial verification says so:

• ARCHITECTURE.md - verified items named explicitly (heartbeat cadence, 15-second grace, result checkpoint, event replay/degradation); the rest is not re-checked.
• INTERFACES.md - same treatment for the replay/degradation boundary, the session/read gap and the default tool count.
• SHARED_CORE.md and ZCODE_RUNTIME.md - 未逐条核对.
• Verified against: ed2d402.

AGENTS.md now spells out the required header fields. The Owner field the review proposed is deliberately not adopted: there is no ownership structure to record. Note that a document cannot name the commit containing itself, so Verified against records the commit the verification was performed against.

ARCHITECTURE.md gains a system overview

Thirty-five lines at the top: a component flow from the Codex host through the MCP server, TaskManager, adapter and ZCode app-server, plus a table of what each component is and is not responsible for. Existing detail is unchanged and now sits under a 运行细节 heading.

ADR-004 accepted with a three-way split

ADR-004 was proposed because the repository had no explicit record of the control/observation boundary. The review correctly pointed out that the original wording conflated two different things. It is now Accepted with this decision:

Type	Example	May write	May decide Bridge state
Control	app-server and supported RPC	yes, through supported semantics	yes, through supported semantics
Supplemental Observation	ZCode local metadata / rollout / log	no	no
Integration Side Effect	tasks-index.sqlite	yes, best effort	no

The key correction: local artifacts may feed a supplemental observation plane for diagnostics and visibility - what is forbidden is their becoming the authority for Bridge lifecycle, state transitions or recovery. Recovery keeps relying on Bridge-owned evidence (TaskStore, heartbeat, attempt, execution.claim, outcome checkpoint, cleanup verification). The Desktop index write is kept but registered as an integration exception with an explicit MUST NOT list: it may not gate execution, change task status, take part in recovery, decide completion, decide cleanup success, or affect the task lifecycle when it fails.

The ADR also now clarifies that src/observation/ is not the ZCode-local observation plane: it derives bounded observations from Bridge-owned TaskStore evidence.

Renamed to ADR-004-separate-control-state-and-observation.md to match the wider scope. PROJECT_STATE.md and INTERFACES.md each gained a pointer to it.

No code was added for reading local ZCode artifacts. The principle is frozen now; whether a ZCodeObserver is worth building is left to the planned Local Observability experiment.

Not done here

• No further directory restructuring. AGENTS.md already carries an explicit split trigger (a document over roughly 15 KB, or one topic read independently by three or more readers).
• ZCODE_RUNTIME.md is not renamed or split; renaming now would break links and buy nothing until the extra ZCode subjects exist as documents.

Validation

• Relative link check across repository markdown and JSON targets - no broken links
• No remaining references to the old root paths or the old ADR-004 filename
• Documentation and AGENTS.md only; no source, schema or bundle change