docs(adr): generated README index, one status-line spelling, shared numbers cited by stem

docs/adr/README.md is now generated by scripts/adr-index.mjs from the records
themselves: status keyword, number, title, date, supersedes / superseded-by,
read from ONE status-line spelling (`**Status**: `). 17 records that spelled
the line another way (`- **Status:**`, `## Status`, `- **状态**:`) are
normalized to it; nothing else in them changes. The four numbers carried by
more than one file (0006 by three versions of one decision; 0010, 0019, 0057
by two unrelated decisions each) are listed side by side in the index and
cross-referenced in each record's header. Nothing is renumbered or moved
(AGENTS.md Prime Directive 13).

check-adr-anchors.mjs becomes unambiguous on those four: a citation may name
the record by its filename stem (`ADR-0057-system-data-lifecycle-and-retention`,
`ADR-0006-project-environment-split.v4`), which resolves to exactly one record;
a stem that names none is an error, a bare number keeps its existing meaning.
The 36 stem-qualified citations in the tree all resolve.

The index script carries a --self-test (46 assertions, 7 pinned batteries) and
is called REPORT-ONLY from the existing lint ADR step via `pnpm adr:index:report`:
a stale index or an unreadable record is a warning annotation, never a red
(maintainer ruling A: 门禁不加). `pnpm adr:index` regenerates.

ui/docs/adr (objectui's own sequence, #26080) is registered in the root index
under the `ui-` prefix with its files untouched; a citation keeps the
`ObjectUI ADR-NNNN` spelling. docs/adr/PRIORITIZATION.md, self-declared retired,
is removed; the one rule it still carried (status hygiene on landing an
implementation) lives in the index's Conventions block, and ADR-0110's pointer
to it now names the README.

Claude-Session: https://claude.ai/code/session_01WGufzgAZv5vcb4H6qvqBAM
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.github/workflows/lint.yml

@@ -604,10 +604,24 @@ jobs:
       # The `--self-test` in the pnpm script provokes that red path on synthetic
       # directories every run, because a collision is rare enough that nobody
       # would otherwise see the gate fail before it mattered.
+      #
+      # #26076: the same step also REPORTS on the generated ADR index
+      # (docs/adr/README.md, `scripts/adr-index.mjs`). Report-only by the
+      # maintainer's ruling (门禁不加): `--report` prints a `::warning::` for a
+      # stale index or a record without the one `**Status**:` spelling and
+      # exits 0 whatever it finds, so the INDEX never reds this step. The
+      # generator's own `--self-test` runs with the flag like every other
+      # script's (check-self-test-wired: an unrun self-test is a phantom check)
+      # — that verifies the script, not the records. `pnpm adr:index`
+      # regenerates; `--check` is the gate's spelling for the day a maintainer
+      # names one.
       - name: ADR anchors + number uniqueness (governed code names its decision)
         id: adr-anchors-number-uniqueness-governed-code
         continue-on-error: true
-        run: pnpm check:adr-anchors
+        run: |
+          pnpm check:adr-anchors
+          node scripts/adr-index.mjs --self-test
+          pnpm adr:index:report
 
       # @objectstack/verify stand-in erasure guard (#6399). The third and
       # narrowest member of the slot-lookup and query-options erasure ratchets

docs/adr/0006-project-environment-split.md

@@ -1,6 +1,7 @@
 # ADR-0006: Environment & Project as Independent Siblings — v3
 
 **Status**: Superseded by v4 (`0006-project-environment-split.v4.md`) — 2026-05-20
+**Versions of this number**: [v2](./0006-project-environment-split.v2.md) · [v3](./0006-project-environment-split.md) · [v4, current](./0006-project-environment-split.v4.md) — one decision revised twice; the number is shared only by its own revisions (AGENTS.md Prime Directive 13). A version is cited as `ADR-0006 v4` in prose or, stem-qualified, as `ADR-0006-project-environment-split.v4`.
 **Date**: 2026-05-20 (v3)
 **Deciders**: ObjectStack Protocol Architects
 **Supersedes**: v1 (strict tree), v2 (siblings + sys_deployment join)

docs/adr/0006-project-environment-split.v2.md

@@ -1,6 +1,7 @@
 # ADR-0006: Three-Layer Tenancy — Organization, Project, Environment
 
 **Status**: Superseded by v4 (`0006-project-environment-split.v4.md`) — 2026-05-20
+**Versions of this number**: [v2](./0006-project-environment-split.v2.md) · [v3](./0006-project-environment-split.md) · [v4, current](./0006-project-environment-split.v4.md) — one decision revised twice; the number is shared only by its own revisions (AGENTS.md Prime Directive 13). A version is cited as `ADR-0006 v4` in prose or, stem-qualified, as `ADR-0006-project-environment-split.v4`.
 **Date**: 2026-05-20 (v1) / 2026-05-20 (v2 — same day revision)
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: ADR-0002 (Environment-Per-Database Isolation), ADR-0003 (Package as First-Class Citizen), ADR-0005 (Metadata Customization Overlay)

docs/adr/0006-project-environment-split.v4.md

@@ -1,6 +1,7 @@
 # ADR-0006: Environment & Project — v4 (drop dev-workspace Project, unify on Package)
 
 **Status**: Accepted (v4 — supersedes v3) — API-surface vocabulary boundary recorded 2026-08-27 (#12473): the v5.0 `project` → `environment` rename stops at the CLI's user-facing vocabulary; three API surfaces keep `project` deliberately (see the addendum). **D1 retired by execution (2026-08-28, #12867 — see the second addendum):** D2 fired on the maintainer's 2026-08-28 ruling; all three of those surfaces are renamed to `environment` / `environments` with no aliases, authored and parked for one coordinated release. Read the first addendum's D1 as history — the boundary it draws no longer exists.
+**Versions of this number**: [v2](./0006-project-environment-split.v2.md) · [v3](./0006-project-environment-split.md) · [v4, current](./0006-project-environment-split.v4.md) — one decision revised twice; the number is shared only by its own revisions (AGENTS.md Prime Directive 13). A version is cited as `ADR-0006 v4` in prose or, stem-qualified, as `ADR-0006-project-environment-split.v4`.
 **Date**: 2026-05-20 (v4)
 **Deciders**: ObjectStack Protocol Architects
 **Supersedes**: v1 (strict tree), v2 (siblings + sys_deployment join), v3 (siblings + deferred dev-workspace `sys_project`)

docs/adr/0009-execution-pinned-metadata.md

@@ -1,6 +1,6 @@
 # ADR-0009: Execution-Pinned Metadata
 
-**Status:** Accepted
+**Status**: Accepted
 **Date:** 2026-05-22
 **Supersedes:** —
 **Builds on:** ADR-0008 (Metadata Repository & Change Log)

docs/adr/0010-metadata-protection-model.md

@@ -2,7 +2,8 @@
 
 > **Protocol 18 update (2026-10-12, ADR-0131 C5, #22340):** The per-type overlay opt-in on `MetadataTypeRegistryEntry` is spelled `allowEnvironmentOverlay` from protocol 18 (`packages/spec/src/kernel/metadata-plugin.zod.ts#allowEnvironmentOverlay`). [ADR-0131](./0131-total-organization-ownership-no-null-organization-id.md) D6 retired the per-organization overlay axis, so the key now names the one scope it governs — whether an environment may overlay an item of this type that a managed package ships. The old key `allowOrgOverride` stays on the registry entry schema only as a tombstone that refuses at parse with the new name in its prescription: no second key, no alias, no conversion. The lines below that name `allowOrgOverride` describe the field as it was spelled when they were written and are preserved verbatim.
 
-**Status:** Proposed
+**Status**: Proposed
+**Shares its number with**: [`0010-nl-to-flow-authoring`](./0010-nl-to-flow-authoring.md) (Natural-Language → Flow Authoring) — an unrelated decision under the same number. Numbers are never reassigned (AGENTS.md Prime Directive 13); cite this record unambiguously as `ADR-0010-metadata-protection-model`.
 **Date:** 2026-05-29
 **Supersedes:** —
 **Builds on:** ADR-0005 (Metadata Customization Overlay), ADR-0008 (Metadata Repository & Change Log), ADR-0009 (Execution-Pinned Metadata)

docs/adr/0010-nl-to-flow-authoring.md

@@ -1,6 +1,7 @@
 # ADR-0010: Natural-Language → Flow Authoring (Platform Capability)
 
 **Status**: Draft (2026-05-24)
+**Shares its number with**: [`0010-metadata-protection-model`](./0010-metadata-protection-model.md) (Metadata Protection Model) — an unrelated decision under the same number. Numbers are never reassigned (AGENTS.md Prime Directive 13); cite this record unambiguously as `ADR-0010-nl-to-flow-authoring`.
 **Authors**: HotCRM (objectstack-ai/hotcrm) — surfacing requirements from the v1 launch story
 **Consumers**: `@objectstack/service-ai`, `@objectstack/spec` (automation), `objectui` (plugin-designer, plugin-chatbot), every app that ships flows
 

docs/adr/0014-record-form-field-type.md

@@ -1,6 +1,6 @@
 # ADR-0014 — `record` Form Field Type
 
-- **Status:** Accepted
+**Status**: Accepted
 - **Date:** 2026-04-17
 - **Supersedes:** —
 - **Related:** ADR-0005 (Metadata Customization Overlay), Prime Directive #1 (Zod First)

docs/adr/0019-app-as-consumer-unit.md

@@ -1,6 +1,7 @@
 # ADR-0019: App as the Consumer-Facing Unit
 
 **Status**: Proposed (v3 — narrowed to the consumer-surface decision)
+**Shares its number with**: [`0019-approval-as-flow-node`](./0019-approval-as-flow-node.md) (Collapse Approval into Flow — approval as a durable-pause node) — an unrelated decision under the same number. Numbers are never reassigned (AGENTS.md Prime Directive 13); cite this record unambiguously as `ADR-0019-app-as-consumer-unit`.
 **Date**: 2026-05-31
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: ADR-0003 (Package as First-Class Citizen), ADR-0006 (Three-Layer Tenancy), ADR-0016 (Studio Package Authoring & Publish)

docs/adr/0019-approval-as-flow-node.md

@@ -1,6 +1,7 @@
 # ADR-0019: Collapse Approval into Flow — one engine, approval as a durable-pause node
 
 **Status**: Accepted (2026-05-31) — fully implemented (A1–A5)
+**Shares its number with**: [`0019-app-as-consumer-unit`](./0019-app-as-consumer-unit.md) (App as the Consumer-Facing Unit) — an unrelated decision under the same number. Numbers are never reassigned (AGENTS.md Prime Directive 13); cite this record unambiguously as `ADR-0019-approval-as-flow-node`.
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0018](./0018-unified-node-action-registry.md) (open action registry — approval becomes a consumer), [ADR-0009](./0009-execution-pinned-metadata.md) (execution pinning — reconcile to one mechanism), [ADR-0012](./0012-notification-platform.md) (outbox / `notify`), [ADR-0010](./0010-nl-to-flow-authoring.md) + [ADR-0011](./0011-actions-as-ai-tools.md) (AI authoring — the design center)
 **Revises**: ADR-0018's premise that Approval stays a separate paradigm with its own closed `ApprovalActionType` enum, and the "Workflow-Rule → Flow compiler" (M5) — both dropped here (greenfield, no legacy).