docs(gov-court): converge governance artifacts to final state

CONTEXT.md

@@ -580,7 +580,7 @@ with a subscription bound draws unlabeled unconditional edges (see
 Strategy-Labeled Edge). Rejected the older "subscription group = a bundle of
 regions" reading, where dragging a subscription silently expanded into a
 hand-written region list: it desynchronized the recorded intent from the
-applied projection (ADR-0075).
+applied projection (former ADR-0075 — record retired 2026-10-15).
 _Avoid_: region bundle, subscription expansion, subscription group drag-fill
 
 ### Strategy-Labeled Edge
@@ -642,8 +642,7 @@ body forwards nothing. `account_add` and `account_bind_ip` are the
 two surviving echoes since ADR-0050 deleted the kernel face; each call
 logs `tracing::warn!` (target `ipc.account_deprecated`). Removal
 condition: an echo is deleted only when the corresponding Resin REST
-endpoint disappears or changes shape (see the AGENTS.md §7.6 echo
-command list) — not merely because it has no caller.
+endpoint disappears or changes shape (see the echo-command contract in `docs/agents/ipc-manifest.md` and the CONTRIBUTING.md IPC rules) — not merely because it has no caller.
 _Avoid_: no-op, stub, dead command (echoes are alive contract surface)
 
 ### White-box Config

CONTRIBUTING.md

@@ -47,18 +47,21 @@ CI runs the same script on every push and pull request. Focused checks:
 
 ## Conventions that gate review
 
-These are enforced by reviewers and CI; full operating rules live in [AGENTS.md](AGENTS.md):
+These rules are authoritative here and are enforced by reviewers and CI (`scripts/verify-build.sh` mounts the machine checks):
 
-- **i18n full-key coverage** — every user-visible string comes from `src/locales/<locale>/*.json` via `t()` / `Trans`; a new key must land in all 18 base locales in the same commit. Never hard-code locale text in components.
-- **Test per behavior** — every public function in `crates/resin-core/` carries a unit test (same file or `crates/resin-core/tests/`); Zustand stores and pure reducers get vitest tests under `src/`; component interactions get Playwright e2e coverage under `e2e/`.
-- **License discipline** — the repository is GPL-3.0-or-later ([LICENSE](LICENSE)); the three license fields are machine-checked; vendored third-party components are registered in [THIRD_PARTY.md](THIRD_PARTY.md).
-- **Docs routing** — the README is a homepage; deep content belongs in `docs/` (architecture, ADRs, how-tos).
+- **i18n full-key coverage** — every user-visible string in `src/` comes from `src/locales/<locale>/*.json` via `t()` / `Trans`; never hard-code locale text in components. A new key must land in **all 18 base locales** in the same commit (`pnpm i18n:check` fails the build otherwise); the `Locale` union in `src/store/appStore.ts` and the `ALL` list in `scripts/i18n-check.cjs` stay in lockstep with the `src/locales/` directories.
+- **Test per behavior** — every public function in `crates/resin-core/` carries a unit test (same-file `#[cfg(test)]` or `crates/resin-core/tests/`); Zustand stores and pure reducers get vitest tests under `src/`; component interactions get Playwright e2e coverage under `e2e/`. The evaluator for the whole repo is `bash scripts/verify-build.sh` (what CI runs on every push/PR).
+- **CI-only delivery** (ADR-0072) — local builds are forbidden as delivery evidence: a source commit is finished when the CI verify job proves it, and a testable exe comes from a release-matrix dispatch. Never hand out a locally-built binary; never claim a UI change is testable before its CI-built artifact exists.
+- **Bilingual README pair** — `README.md` is the EN-canonical homepage skeleton (preserve its section order; route deep content to `docs/`); `README_CN.md` is the structure-locked CN mirror held 1:1 by `scripts/readme-lang-check.cjs` — update both sides and the script mapping table in the same commit. The `## License` body stays exactly `GPL-3.0-or-later`.
+- **License discipline** — the repository is GPL-3.0-or-later via [LICENSE](LICENSE) (verbatim GNU text — never reword); the README / workspace `Cargo.toml` / `package.json` license fields are machine-checked (`scripts/license-field-check.cjs`); vendored third-party components register in [THIRD_PARTY.md](THIRD_PARTY.md) with the two-layer declared-vs-tree value. Mere-aggregation invariant (ADR-0067): shell ↔ sidecar interact only over the loopback REST seam — no FFI, no in-process linking, no source embedding. On any `docs/RESIN_UPSTREAM_MANIFEST.yaml` version bump, re-verify license facts against upstream originals at that tag and update `THIRD_PARTY.md` + the manifest in the same commit.
+- **IPC & security contracts** — every `#[tauri::command]` validates input at the IPC layer before calling resin-core (lane range `0..MAX_LANES`, length caps ≤253 + NUL rejection, latency cap, `http(s)://` URL prefix); TS wrappers in `src/lib/ipc.ts` validate-then-invoke and treat Rust responses as untrusted. The headless router keeps **every** route behind `security_guard` in `src-tauri/src/headless_main.rs` (`--auth-token` on `/api/v1/*` + `/metrics/*`, Host/Origin allowlist, CSPRNG token — never register a route above the `.layer(...)` call). The IPC manifest (`docs/agents/ipc-manifest.md`) is machine-checked — regenerate with `node scripts/ipc-manifest-check.cjs --write`, do not hand-edit.
+- **Docs routing** — the README is a homepage; deep content belongs in `docs/` (architecture, ADRs, how-tos). Retired docs are deleted, not archived in-tree — history lives in git.
 
 ## Commit and branch style
 
 - Branch names are free-form; keep one logical change per branch and pull request.
 - Commit subjects stay short and area-scoped (for example, `gateway: lane hash + SSE lease`); the body explains what changed and why.
-- Update [AGENTS.md](AGENTS.md) in the same commit when a change alters structure, conventions, or the release protocol.
+- Update this file (conventions) and the pointer docs (`AGENTS.md`, `docs/agents/`) in the same commit when a change alters structure, conventions, or the release protocol.
 
 ## Pull requests
 

README.md

@@ -119,7 +119,7 @@ pnpm tauri dev
 | [docs/architecture/ARCHITECTURE.md](docs/architecture/ARCHITECTURE.md) | Layers, data flow, config authority (L1/L2/L3), tech stack |
 | [docs/architecture/UPSTREAM.md](docs/architecture/UPSTREAM.md) | Upstream Resin integration router: API coverage, version manifest, third-party obligations |
 | [docs/RELEASE_NOTES.md](docs/RELEASE_NOTES.md) | Per-release notes with compatibility declarations and upgrade notes |
-| [docs/adr/](docs/adr/) | Architectural decision records (numbered, append-only) |
+| [docs/adr/](docs/adr/) | Architectural decision records (numbered; retired records live in git history) |
 | [docs/how-to/HEADLESS_DEPLOYMENT.md](docs/how-to/HEADLESS_DEPLOYMENT.md) | Headless server deployment (systemd, Docker, TLS) |
 | [docs/how-to/HEADLESS_RUNBOOK.md](docs/how-to/HEADLESS_RUNBOOK.md) | Headless operations (logs, health, shutdown, troubleshooting) |
 | [docs/how-to/RELEASE.md](docs/how-to/RELEASE.md) | Release pipeline: CI matrix, artifact groups |
@@ -130,7 +130,7 @@ pnpm tauri dev
 
 ## Contributing
 
-Issues and pull requests are welcome. Start with [CONTRIBUTING.md](CONTRIBUTING.md) — desktop dev-environment setup and the verification workflow. Security issues follow [SECURITY.md](SECURITY.md) (private vulnerability reporting, never public issues); community behavior is covered by the [Code of Conduct](CODE_OF_CONDUCT.md); questions and open discussion belong in [Discussions](https://github.com/Xxx91n/EgressAPIKEY/discussions). Before your first PR, read [AGENTS.md](AGENTS.md) (repo conventions: i18n full-key coverage, test-per-behavior, license-field discipline) and the [architecture overview](docs/architecture/ARCHITECTURE.md).
+Issues and pull requests are welcome. Start with [CONTRIBUTING.md](CONTRIBUTING.md) — desktop dev-environment setup and the verification workflow. Security issues follow [SECURITY.md](SECURITY.md) (private vulnerability reporting, never public issues); community behavior is covered by the [Code of Conduct](CODE_OF_CONDUCT.md); questions and open discussion belong in [Discussions](https://github.com/Xxx91n/EgressAPIKEY/discussions). Before your first PR, read [CONTRIBUTING.md](CONTRIBUTING.md) (repo conventions: i18n full-key coverage, test-per-behavior, license-field discipline) and the [architecture overview](docs/architecture/ARCHITECTURE.md). Agent operating pointers live in [AGENTS.md](AGENTS.md).
 
 ## Third-party notices
 

README_CN.md

@@ -119,7 +119,7 @@ pnpm tauri dev
 | [docs/architecture/ARCHITECTURE.md](docs/architecture/ARCHITECTURE.md) | 分层、数据流、配置权威（L1/L2/L3）、技术栈 |
 | [docs/architecture/UPSTREAM.md](docs/architecture/UPSTREAM.md) | 上游 Resin 对接总纲：API 覆盖清单、版本清单、第三方义务 |
 | [docs/RELEASE_NOTES.md](docs/RELEASE_NOTES.md) | 每版本发布说明：兼容性声明与升级注意事项 |
-| [docs/adr/](docs/adr/) | 架构决策记录（编号、只追加） |
+| [docs/adr/](docs/adr/) | 架构决策记录（编号；退役记录存于 git 历史） |
 | [docs/how-to/HEADLESS_DEPLOYMENT.md](docs/how-to/HEADLESS_DEPLOYMENT.md) | 无头服务器部署（systemd、Docker、TLS） |
 | [docs/how-to/HEADLESS_RUNBOOK.md](docs/how-to/HEADLESS_RUNBOOK.md) | 无头服务器运维（日志、健康、停机、故障排查） |
 | [docs/how-to/RELEASE.md](docs/how-to/RELEASE.md) | 发布流水线：CI 矩阵、产物分组 |
@@ -130,7 +130,7 @@ pnpm tauri dev
 
 ## 参与贡献
 
-欢迎提交 Issue 与 Pull Request —— 请到 [GitHub Issue](https://github.com/Xxx91n/EgressAPIKEY/issues)。首次提交 PR 前，请先阅读 [AGENTS.md](AGENTS.md)（仓库约定：i18n 全键覆盖、每个行为必须有测试、许可证字段纪律）与[架构总览](docs/architecture/ARCHITECTURE.md)。包含桌面开发环境搭建的独立 `CONTRIBUTING.md` 已列入路线图。
+欢迎提交 Issue 与 Pull Request —— 请到 [GitHub Issue](https://github.com/Xxx91n/EgressAPIKEY/issues)。首次提交 PR 前，请先阅读 [CONTRIBUTING.md](CONTRIBUTING.md)（仓库约定：i18n 全键覆盖、每个行为必须有测试、许可证字段纪律）与[架构总览](docs/architecture/ARCHITECTURE.md)。Agent 操作指引见 [AGENTS.md](AGENTS.md)。
 
 ## 第三方声明