docs(adr): status-hygiene sweep — fix 0096 collision, flip implemented statuses, mark PRIORITIZATION stale

Follow-up to the ADR-0086 re-evaluation (#2557): an audit of docs/adr found
three hygiene defects; this fixes the mechanical ones.

1. Resolve the ADR-0096 numbering collision. Two unrelated ADRs landed as
   0096 on the same day; the first-merged one (execution-surface identity
   admission, #2975) keeps 0096, and the connector ADR (#2977) is renumbered
   to ADR-0097. All connector-semantic "ADR-0096" references in code comments,
   test titles, and zod describe/message strings are updated to ADR-0097;
   execution-surface references (http-dispatcher, authz-conformance,
   graphql/realtime contracts, service-realtime README) are untouched.
   CHANGELOGs and commit history are left as historical record.

2. Flip Status lines of implemented ADRs that were still Proposed, with
   evidence: 0093 (tenancy service + membership reconciler + dogfood test)
   and 0095 (tenant-layer.ts + posture-ladder.ts + matrix-gate tests).
   Verified code+tests on main before flipping; other stale-looking ADRs
   (0049/0056/0057/0066/...) are left for per-ADR verification.

3. Mark docs/adr/PRIORITIZATION.md as a historical snapshot (it predates
   ADR-0050+) and record the status-hygiene rule: the PR that lands an ADR's
   implementation flips its Status line with one line of evidence.

Author: claude

docs/adr/0093-tenancy-mode-and-membership-lifecycle.md

@@ -1,6 +1,6 @@
 # ADR-0093: Tenancy mode as a first-class capability, and a single owner for the user→membership lifecycle
 
-- **Status:** Proposed (implementation in progress)
+- **Status:** Accepted (2026-07-13) — implemented: `tenancy` kernel service (`plugin-auth/src/tenancy-service.ts`), membership reconciler (`reconcile-membership.ts`), locked by `dogfood/test/membership-reconciler.dogfood.test.ts`
 - **Date:** 2026-07-13
 - **Deciders:** ObjectStack Protocol Architects
 - **Implementation:** #2882 (Phase 0 — tactical create-user bind, merged) → this PR (Phases 1–3 — `tenancy` service, fail-fast boot guard, membership reconciler, consumer migration, backfill, docs). One revision from the original plan, ratified in D2: the endpoint-level create-user bind **delegates to the shared reconciler** (one implementation, two call sites) instead of being deleted. Runtime verification confirmed the hook fires for `admin.createUser`, but better-auth *defers* `user.create.after` post-commit (#1881), so the endpoint keeps its delegated call to report `organizationId` / `membershipCreated` deterministically in its response. Cloud-host semantics (personal-org hook precedence, multi-org non-binding, D5 blast radius) verified against `objectstack-ai/cloud` — see D2/D3/D5.

docs/adr/0095-authz-kernel-tenant-layer-and-posture-ladder.md

@@ -1,6 +1,6 @@
 # ADR-0095: Authorization Kernel Chain — Tenant Isolation as Layer 0, a Monotonic Posture Ladder, Capability-Derived Posture
 
-**Status**: Proposed (2026-07-14)
+**Status**: Accepted (2026-07-14) — implemented: D1 tenant Layer 0 (`plugin-security/src/tenant-layer.ts`), D2/D3 posture ladder (`core/src/security/posture-ladder.ts`), locked by `authz-matrix-gate.test.ts` + `posture-ladder.test.ts` (#2920 B1–B4)
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0002](./0002-environment-database-isolation.md) (environment-per-database), [ADR-0057](./0057-erp-authorization-core-business-units-and-scope-depth.md) (scope depth), [ADR-0066](./0066-unified-authorization-model.md) (unified authz model, superuser bypass), [ADR-0090](./0090-permission-model-v2-concept-convergence.md) (permission model v2), [ADR-0093](./0093-tenancy-mode-and-membership-lifecycle.md) (tenancy service)
 **Scopes**: the "cross-tenant RLS does not exist here" claim in [ADR-0073](./0073-automation-execution-identity.md) (see Context)

…/0096-declarative-connector-instances.md …/0097-declarative-connector-instances.mddocs/adr/0096-declarative-connector-instances.md renamed to docs/adr/0097-declarative-connector-instances.md docs/adr/0096-declarative-connector-instances.md renamed to docs/adr/0097-declarative-connector-instances.md

@@ -1,4 +1,4 @@
-# ADR-0096: Declarative Connector Instances — Provider-Bound `connectors:` Entries Materialized by Generic Executors
+# ADR-0097: Declarative Connector Instances — Provider-Bound `connectors:` Entries Materialized by Generic Executors
 
 **Status**: Accepted (2026-07-15) — implemented in framework#2977
 **Deciders**: ObjectStack Protocol Architects

docs/adr/PRIORITIZATION.md

@@ -1,5 +1,17 @@
 # ADR Prioritization Review
 
+> ⚠️ **STALE (noted 2026-07-16):** this review predates ADR-0050 onward — the directory now
+> reaches ADR-0097, so everything from 0050 up is outside its scope, and several statuses it
+> records for 0001–0049 have since moved. Treat it as a historical snapshot, not current
+> state. The `Status:` header of each ADR file (kept current per the hygiene rule below) is
+> the authority; this document is retained for its method and its ranked-plan rationale.
+>
+> **Status-hygiene rule (adopted 2026-07-16):** when a PR lands the implementation of an ADR,
+> the same PR (or an immediate follow-up) must flip that ADR's `Status:` line to
+> `Accepted — implemented` with one line of evidence (key file + test). An ADR left
+> `Proposed` after its code ships misleads every later reader — this is the same
+> no-silently-stale discipline as ADR-0078, applied to the ADRs themselves.
+
 > **Date:** 2026-06-12
 > **Scope:** All 49 ADRs in `docs/adr/`, cross-checked against actual code on `main`.
 > **Method:** Every unfinished ADR was read in full and its `Status:` header was

examples/app-showcase/src/automation/flows/index.ts

@@ -395,22 +395,22 @@ export const TaskCompletedRestPingFlow = defineFlow({
 });
 
 /**
- * Declarative Connector Ping — the worked ADR-0096 example: a `connector_action`
+ * Declarative Connector Ping — the worked ADR-0097 example: a `connector_action`
  * dispatching a **provider-bound declarative connector instance**.
  *
  * Where {@link TaskCompletedRestPingFlow} targets the `rest` connector a *plugin*
  * registered (ConnectorRestPlugin, ADR-0018 §Addendum), this flow targets
  * `showcase_status_api` — a connector declared as pure metadata in
  * src/system/connectors/ and *materialized* into the registry at boot by the
- * `rest` generic executor (ADR-0096). Nothing registered it in code: the
+ * `rest` generic executor (ADR-0097). Nothing registered it in code: the
  * `connectors:` entry named `provider: 'rest'`, and the automation service turned
  * it into a live connector. On task creation the flow issues `GET /api/v1/health`
  * through it; the call and its `{ status: 'ok' }` response are captured on the
  * flow run, proving the declarative path dispatches end-to-end.
  */
 export const ShowcaseDeclarativeConnectorPingFlow = defineFlow({
   name: 'showcase_declarative_connector_ping',
-  label: 'Declarative Connector Ping (ADR-0096)',
+  label: 'Declarative Connector Ping (ADR-0097)',
   description:
     'Dispatches GET /api/v1/health through showcase_status_api — a provider-bound connector instance materialized from pure metadata at boot.',
   type: 'autolaunched',

examples/app-showcase/src/coverage.ts

@@ -179,7 +179,7 @@ export const STACK_COLLECTION_COVERAGE: Record<string, KindCoverage> = {
     status: 'demonstrated',
     files: ['src/system/connectors/index.ts', 'src/automation/flows/index.ts'],
     notes:
-      'Both connector kinds are demonstrated. (1) Provider-bound INSTANCE (ADR-0096 / #2977): StatusApiConnector declares `provider: rest` and is materialized into a live, dispatchable connector at boot by ConnectorRestPlugin\'s provider factory — ShowcaseDeclarativeConnectorPingFlow calls it via connector_action and it appears in GET /connectors. (2) Catalog DESCRIPTOR (#2612): ErpCatalogConnector has no provider, so it stays inert metadata; enabled:false marks the deliberate catalog entry and silences the boot audit. Plugin-registered connectors (ConnectorRestPlugin/ConnectorSlackPlugin in objectstack.config.ts) are also exercised by the connector flows.',
+      'Both connector kinds are demonstrated. (1) Provider-bound INSTANCE (ADR-0097 / #2977): StatusApiConnector declares `provider: rest` and is materialized into a live, dispatchable connector at boot by ConnectorRestPlugin\'s provider factory — ShowcaseDeclarativeConnectorPingFlow calls it via connector_action and it appears in GET /connectors. (2) Catalog DESCRIPTOR (#2612): ErpCatalogConnector has no provider, so it stays inert metadata; enabled:false marks the deliberate catalog entry and silences the boot audit. Plugin-registered connectors (ConnectorRestPlugin/ConnectorSlackPlugin in objectstack.config.ts) are also exercised by the connector flows.',
   },
 };
 

examples/app-showcase/src/system/connectors/index.ts

@@ -3,7 +3,7 @@
 import { defineConnector, type Connector } from '@objectstack/spec/integration';
 
 /**
- * Declarative `connectors:` — the collection now holds BOTH kinds (ADR-0096):
+ * Declarative `connectors:` — the collection now holds BOTH kinds (ADR-0097):
  *
  * 1. **Provider-bound instance** ({@link StatusApiConnector}) — a live,
  *    dispatchable connector authored as pure metadata. It names a `provider`
@@ -14,7 +14,7 @@ import { defineConnector, type Connector } from '@objectstack/spec/integration';
  *    indistinguishable from a hand-written connector — `connector_action`
  *    dispatches it and `GET /connectors` lists it. {@link
  *    file://../../automation/flows/index.ts | ShowcaseDeclarativeConnectorPingFlow}
- *    calls it end-to-end. This is the #2977 / ADR-0096 upgrade of what used to
+ *    calls it end-to-end. This is the #2977 / ADR-0097 upgrade of what used to
  *    be a purely descriptor-only collection.
  *
  * 2. **Catalog descriptor** ({@link ErpCatalogConnector}, the #2612 interim
@@ -31,7 +31,7 @@ import { defineConnector, type Connector } from '@objectstack/spec/integration';
  */
 
 /**
- * ADR-0096 provider-bound instance — declared as pure metadata, materialized
+ * ADR-0097 provider-bound instance — declared as pure metadata, materialized
  * into a live `rest` connector at boot by ConnectorRestPlugin's provider factory
  * (which the plugin registers even though, here, it is also configured with a
  * hand-wired `rest` connector). Points at the running server itself, so
@@ -45,7 +45,7 @@ export const StatusApiConnector = defineConnector({
   label: 'Status API (Declarative REST Instance)',
   type: 'api',
   description:
-    'Provider-bound declarative connector instance (ADR-0096): authored as metadata, materialized into a live, ' +
+    'Provider-bound declarative connector instance (ADR-0097): authored as metadata, materialized into a live, ' +
     'dispatchable `rest` connector at boot. Unlike the ERP descriptor below, this one IS callable from a flow ' +
     'connector_action and appears in GET /connectors.',
   provider: 'rest',
@@ -69,7 +69,7 @@ export const ErpCatalogConnector = defineConnector({
   authentication: { type: 'api-key', key: 'SET_AT_INSTALL_TIME', headerName: 'X-API-Key' },
   // Descriptor-level action catalog: key + label + I/O JSON Schemas. Note the
   // deliberate absence of any execution binding (HTTP method/path) — that is
-  // what keeps descriptors inert today and what ADR-0096's provider binding
+  // what keeps descriptors inert today and what ADR-0097's provider binding
   // supplies declaratively.
   actions: [
     {

packages/connectors/connector-mcp/src/connector-mcp-plugin.ts

@@ -7,7 +7,7 @@ import { createMcpProviderFactory, MCP_PROVIDER_KEY } from './mcp-provider.js';
 
 /**
  * Minimal surface of the automation engine this plugin depends on — the
- * connector registry (ADR-0018 §Addendum) plus the provider registry (ADR-0096).
+ * connector registry (ADR-0018 §Addendum) plus the provider registry (ADR-0097).
  * Kept structural so the plugin needs no runtime dependency on
  * `@objectstack/service-automation`.
  */
@@ -24,7 +24,7 @@ export interface ConnectorRegistrySurface {
 }
 
 /**
- * Options for {@link ConnectorMcpPlugin}. All optional (ADR-0096): with no
+ * Options for {@link ConnectorMcpPlugin}. All optional (ADR-0097): with no
  * `transport` the plugin contributes only the `mcp` provider factory — so a
  * stack can declare `provider: 'mcp'` instances as pure metadata. Supply a
  * `transport` to ALSO connect one hand-wired MCP server at `start()`.
@@ -34,7 +34,7 @@ export interface ConnectorMcpPluginOptions extends Partial<McpConnectorOptions>
 /**
  * ConnectorMcpPlugin — contributes the generic MCP adapter (ADR-0024) in two forms:
  *
- *  1. **Provider factory** (`mcp`, ADR-0096): registered at `init()` so the
+ *  1. **Provider factory** (`mcp`, ADR-0097): registered at `init()` so the
  *     automation service can materialize declarative `provider: 'mcp'`
  *     `connectors:` entries — connecting to the server and mapping its tools to
  *     connector actions — at boot.
@@ -65,7 +65,7 @@ export class ConnectorMcpPlugin implements Plugin {
     }
 
     async init(ctx: PluginContext): Promise<void> {
-        // Contribute the `mcp` provider factory (ADR-0096) before the automation
+        // Contribute the `mcp` provider factory (ADR-0097) before the automation
         // service materializes declarative instances during its start().
         const automation = this.tryGetAutomation(ctx);
         if (automation && typeof automation.registerConnectorProvider === 'function') {

packages/connectors/connector-mcp/src/mcp-provider.test.ts

@@ -1,6 +1,6 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 //
-// ADR-0096 — the `mcp` provider factory: materialize a declarative
+// ADR-0097 — the `mcp` provider factory: materialize a declarative
 // `provider: 'mcp'` connector instance by connecting to the server (an injected
 // fake client here), listing its tools, and mapping them to actions.
 
@@ -33,7 +33,7 @@ function ctx(partial: Partial<ConnectorProviderContext> & Pick<ConnectorProvider
     return { name: 'github', label: 'GitHub', type: 'api', ...partial };
 }
 
-describe('mcp provider factory (ADR-0096)', () => {
+describe('mcp provider factory (ADR-0097)', () => {
     it('advertises the mcp provider key', () => {
         expect(MCP_PROVIDER_KEY).toBe('mcp');
     });

packages/connectors/connector-mcp/src/mcp-provider.ts

@@ -4,7 +4,7 @@ import type { ConnectorProviderFactory, ResolvedConnectorAuth } from '@objectsta
 import { createMcpConnector, type McpConnectorOptions, type McpTransport } from './mcp-connector.js';
 
 /**
- * The provider key this package contributes (ADR-0096). A declarative
+ * The provider key this package contributes (ADR-0097). A declarative
  * `connectors:` entry with `provider: 'mcp'` is materialized by this factory.
  */
 export const MCP_PROVIDER_KEY = 'mcp';
@@ -96,15 +96,15 @@ function normalizeTransport(
 }
 
 /**
- * Build the `mcp` {@link ConnectorProviderFactory} (ADR-0096 / ADR-0024). At boot
+ * Build the `mcp` {@link ConnectorProviderFactory} (ADR-0097 / ADR-0024). At boot
  * the automation service invokes it for each `provider: 'mcp'` declarative
  * instance: it connects to the MCP server named by `providerConfig.transport`,
  * lists its tools, and produces the same `{ def, handlers, close }` bundle
  * {@link createMcpConnector} builds for a hand-wired MCP connector — one action
  * per tool, dispatched to the server's `tools/call`.
  *
  * The connection is opened at materialization; an unreachable server or invalid
- * transport therefore fails boot loudly (ADR-0096 fail-loud contract). Prefer a
+ * transport therefore fails boot loudly (ADR-0097 fail-loud contract). Prefer a
  * fail-soft plugin instantiation for an *optional* server.
  */
 export function createMcpProviderFactory(deps: McpProviderDeps = {}): ConnectorProviderFactory {