docs(adr): ADR-0126 stops deferring the package-upgrade.zod.ts retirement; ADR-0138 D5 says who opens a future site binding (#25716)

Refs #25608

Docs only, two governed sentences: the governed half of #25608, split
off from the code PR because `docs/adr/**` is a Tier H surface. **It
merges after the code PR** on
`claude/issue-25608-retire-package-upgrade`, because the ADR-0126
sentence describes that PR's retirement as done.

## 维护者速读

- **改了什么：** 两个 ADR 各改一句。ADR-0126 里原句说 `package-upgrade.zod.ts` 的退役「v18
后再做」，改为「第 3 项已整体退役该文件，其升级计划/差异/快照/回滚模型从未实现，墙边没有并存的升级协议」。ADR-0138 D5
末尾加一句：若将来建公开站点绑定，绑定由组织管理员在自己的组织里开，不由包声明（附裁决原话）。
- **为什么改：** 代码 PR 删掉了该文件，ADR-0126 的原句随之变假；ADR-0138 那句是裁决 A `6386464761`
点名要求加的，并指定随 spec 车道下一个 docs PR 走。
- **风险与代价（含回滚）：** 只动两段文字，不改任何决定、代码或生成物，不发布任何包。回滚就是 revert
这一个提交。唯一的顺序风险：若先于代码 PR 合并，ADR-0126 那句会短暂描述一个尚未落地的退役。
- **席位意见：**
- **你要做的：** 等代码 PR 合并后，审读这两句并批准合并（Tier H，需你本人批准）。

## What changed

- `docs/adr/0126-packaged-metadata-customization-model.md` (the
2026-10-23 note on wall 3): the bullet said the other classes follow
after v18, "as does the retirement of `package-upgrade.zod.ts`". The
file is retired in 18.x by ruling `6259332195` item 3, so the bullet now
keeps the item-4 sentence and says item 3 retired the file whole, with
no upgrade protocol standing beside the wall.
-
`docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md`,
D5: one sentence ordered by ruling A `6386464761` on #25574, in English
with the ruling's own words beside it: "If this is built later, the
binding is opened by the organization administrator inside their own
organization, never declared by the package (ruling A `6386464761`:
「若将来建，绑定由组织管理员开，不由包声明」)."

The ruling's text, verbatim: 「ADR-0138 D5 加一句「若将来建，绑定由组织管理员开，不由包声明」。Tier
H，随 spec 车道下一个 docs PR 走，维护者手合；不单开 PR。」 This PR is that lane's next docs
PR: it carries the ADR-0126 correction the #25608 retirement needs, and
the D5 sentence rides with it rather than in a PR of its own. It sits
beside the code PR rather than inside it because a governed path never
rides a code PR.

## Changeset

`skip-changeset`: the diff is `docs/adr/**` only, which ships in no
package's `files[]`, so it publishes nothing.

## Gates

Derived with `node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` at `87750ce9a`: 20 families, all run, every
one `exit 0` (exit codes captured before any pipe), and `--ran`
reconciles them: "20 derived famil(ies) accounted for — 20 run, 0
NOT-MEASURED (a DERIVED zero — all 20 recorded an exit code and none of
them is 3)". `check:doc-formula-expressions` first answered exit 3
(`@objectstack/lint` unbuilt in a fresh worktree, nothing measured);
after `turbo run build --filter=@objectstack/formula
--filter=@objectstack/lint` it answered exit 0, and that is the reading
recorded.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01T5pRzjp4QpCwioKZ9Gt5tC

---
_Generated by [Claude
Code](https://claude.ai/code/session_01T5pRzjp4QpCwioKZ9Gt5tC)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

docs/adr/0126-packaged-metadata-customization-model.md

@@ -317,8 +317,10 @@ read at each runtime's own consult point; an empty ledger changes nothing anywhe
    >   install of a package shipping a catalog name an environment-authored item holds writes its
    >   install entry, and the next cold boot refuses; it is to be refused before the first write, not
    >   confirmed (#25366).
-   > - **The other classes follow after v18** (ruling item 4), as does the retirement of
-   >   `package-upgrade.zod.ts`. Until then this wall holds in practice for the access class only.
+   > - **The other classes follow after v18** (ruling item 4). Until then this wall holds in
+   >   practice for the access class only. Item 3 retired `kernel/package-upgrade.zod.ts` whole
+   >   (#25608): its upgrade plan, diff, snapshot and rollback model had no implementation, so no
+   >   upgrade protocol stands beside this wall.
 4. **The paper protocol is not the model.** The three-layer
    `metadata-customization.zod.ts` surface (#12057 — exported, documented, zero consumers) is
    **superseded by this ADR as a matter of record**: nothing may build against it, and its

docs/adr/0138-guest-model-anonymous-principal-doors-grants-and-organization.md

@@ -475,6 +475,9 @@ enforcer in the same change. The measured demand at `7b926f7600` is none: the re
 apps open public forms on a single organization, and the measurement round found the same in the
 hotcrm tree. The trigger is a named deployment that needs it.
 
+If this is built later, the binding is opened by the organization administrator inside their own
+organization, never declared by the package (ruling A `6386464761`: 「若将来建，绑定由组织管理员开，不由包声明」).
+
 ### D6 — Disclosure and explain: unchanged
 
 *Ruled: Q6 A.* ADR-0106 D7 stands: a caller resolving no set takes the configured fallback set on