docs: verify the managed workspace docs against main (#3522)

[BigDataDZ]

Summary

The Managed workspace group of the #3522 docs-verification campaign — with a scope correction first: three of the group's five documents no longer exist. runtime-managed-workspace-baseline-open-v1, -execution-admission-v1, and -owner-v1 were removed intentionally by #4174 ("refactor: remove dormant Git workspace write path", f689c34, 2026-08-29) together with the entire implementation they described (git-workspace-service.ts, managed-workspace-owner.ts, and the internal authorities/tests, ~8.6k lines). No dangling links point at them, and the two surviving documents already agree with the removal. This PR therefore verifies the two surviving documents; the tracking issue's group checklist needs the same correction.

Verification results

Both surviving documents verified clean against main — every symbol, SQLite table, schema narrative, failpoint set, and CI claim checked out:

• runtime-workspace-version-authority-v1.zh-CN.md: PASS. Verified runtime_workspace_epochs/versions/heads, runtime_managed_mutation_reservations, runtime_storage_root_binding, capability runtime_workspace_version_authority@1, schema 20 and the schema 7-20 narratives, the root-binding fail-closed rules, the five baseline failpoints, the Linux-CI/Windows-recovery-gate vs macOS claims, and all cross-references to the mutation-lifecycle sibling doc. It had no front matter; added translation_status/last_verified and refreshed the update date (content changed via docs(architecture): audit managed workspace authorities #4718 after the date).
• managed-dependency-storage-authority-v1.zh-CN.md: PASS. Verified ManagedDependencyEnvironmentAuthority, the receipt database path, the cross-process owner lock, lifecycle/GC/quota fail-closed behavior, and the extraction-ledger file list. last_verified 2026-09-04 → 2026-10-10 (docs(architecture): audit managed workspace authorities #4718 added that field when it audited this same group a day earlier; this PR re-verifies against a newer main).

Metadata-only change; no code paths touched.

Refs #3522

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: ZCode (GLM). Ran the doc-vs-code verification pass and drafted the metadata updates; the human contributor reviewed the findings and owns the result. Commits carry Generated-by: ZCode.

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

Full review of db3a1e06 against main 2463d86c (the merge-base is current main). The PR changes metadata only, in 2 files (+7/-2): it bumps last_verified on managed-dependency-storage-authority-v1.zh-CN.md, and adds front matter plus a refreshed update date to runtime-workspace-version-authority-v1.zh-CN.md. No code or protocol files are touched, so there is no epoch impact.

Claims checked against main

• Scope correction (three docs removed): holds. runtime-managed-workspace-baseline-open-v1, -execution-admission-v1 and -owner-v1 were deleted in f689c3407 (#4174), together with managed-workspace-owner.ts. git grep finds no remaining references to them.
• Schema 20: holds. packages/storage/src/sqlite-runtime-schema.ts:37 has SQLITE_RUNTIME_SCHEMA_VERSION = 20.
• Capability runtime_workspace_version_authority @ 1: holds (sqlite-runtime-schema.ts:42-43).
• The five tables: hold. runtime_workspace_epochs/versions/heads, runtime_managed_mutation_reservations and runtime_storage_root_binding all exist in the schema and its tests.
• Windows CI claims: hold. windows-baseline.yml runs sqlite-recovery-concurrency.test.js (:166) with continue-on-error (:42, :83, :94).
• New update-date line: holds. #4718 was merged 2026-10-09T12:50Z, and it set the old date to 2026-10-08.
• Managed-dependency doc: holds. ManagedDependencyEnvironmentAuthority and all five cited source and test paths exist. The DB path managed-workspaces/dependency-environment-authority-v1.sqlite matches managed-dependency-environment.ts:556-560. The .lock file is at :722, and PRAGMA synchronous = FULL is at :343.
• Front-matter placement: consistent. Putting the YAML before the ASF comment matches the sibling doc and translation_status: source-only users such as bot-onboarding-runtime.zh-CN.md.

Findings

• P3 (PR description only): the description says #4718 "updated the document without bumping" last_verified on the managed-dependency doc. In fact #4718 added last_verified: 2026-09-04 to that file. The description could also note that #4718 already audited this same #3522 group a day earlier, so this PR is a re-verification. There is no doc impact.

Mergeability/CI: MERGEABLE, with merge state BLOCKED only on required review. The single check (label) passes.

Verdict: the docs are accurate against current main, and I found no P0-P2 issues.

[Astro-Han]

Approved at @Astro-Han's explicit request: the automated review of this exact head found no blocking (P0–P2) issues, and CI is green.

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

Update at db3a1e06: the prose changes still look accurate, but the PR now fails CI. I approved the pending fork run, and it ran for the first time on this head.

P2: Check ASF source headers fails because of the added frontmatter. CI run 38034660091 reports that the following file(s) "carry the ASF license text in a form this policy does not render":

• docs/architecture/runtime-workspace-version-authority-v1.zh-CN.md

The PR adds a new --- frontmatter block above the existing license comment and leaves a blank line between the closing --- and <!--. Docs that already have frontmatter on main put the license comment directly after the closing ---, with no blank line (for example docs/skill-catalog-policy.md). To fix this, delete the blank line, or merge the new keys into an existing frontmatter block. Then run npm run check:asf-headers locally.

No other findings.

[Astro-Han]

P2: the blank line between the closing --- and <!-- makes check:asf-headers reject this file. Put the license comment directly after ---, as docs/skill-catalog-policy.md does.

Withdrawn: CI's ASF header check fails on this head (see the automated review comment). I'll re-approve once it is green.

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

Incremental review to 5caaf21f. The only change since our last review is removing the blank line between the closing frontmatter --- and the license comment, as suggested. The P2 is resolved: test (including Check ASF source headers) now passes on this head. No other findings.

[Astro-Han]

Approved at @Astro-Han's explicit request: the automated review of this exact head found no blocking (P0–P2) issues, and CI is green.