docs: reconcile canonical memory with merged Go backend

.project-docs/40-domain/business-rules.md

@@ -2,12 +2,22 @@
 
 ## Durable Rules
 
-- {business or product rule}
+- Production data backend selection is explicit and fail-closed: a PostgreSQL configuration failure must never silently fall back to local JSON.
+- Billing amounts use integer-fen arithmetic; wallet balance enforcement and ledger insertion happen inside the PostgreSQL `billing_post_wallet_entry` function.
+- Job claiming uses the PostgreSQL `claim_generation_jobs` function (`FOR UPDATE SKIP LOCKED`, lease, stale recovery); Go process-local locks must never replace it.
+- Ordinary members cannot submit generation when the organization balance is insufficient; submission is rejected before provider dispatch.
+- Super administrators calculate and record generation cost without checking, freezing, or refunding organization quota.
+- All new organization balance entries are organization-owned; generation charge/refund entries keep member attribution for consumption reporting.
+- Logged-in users may change their own password; account management and organization member actions require admin roles.
+- Public `/api/v1` access authenticates with API keys and stays outside browser SSO middleware; API data is partitioned by the API account owner.
+- Database schema changes ship as versioned, checksummed, advisory-locked one-shot migrations; they never run in each Web pod init container.
+- Generated and uploaded assets remain runtime/object-storage state; PostgreSQL does not make them shared for horizontal scaling.
 
 ## Open Questions
 
-- {rule that needs human confirmation}
+- Whether Go must parse existing `zhinian_session` cookies without logout, or a one-time global re-login is acceptable at cutover.
+- The exact public `/api/v1` compatibility promise to preserve during and after the Go cutover.
 
 ## Last Reviewed
 
-{YYYY-MM-DD}
+2026-08-14

.project-docs/40-domain/glossary.md

@@ -2,3 +2,15 @@
 
 | Term | Meaning | Notes |
 |---|---|---|
+| 素材 / Material | Uploaded source content referenced in prompts as `@图片1`, `@视频1`, `@音频1`. | Uploads become assets under the authenticated owner. |
+| Asset | Stored upload or generated result with metadata and owner scope. | Owner-scoped not-found behavior (404) is a compatibility contract. |
+| Generation job / Task | Async unit of image or video generation: submit, claim, execute, poll provider, terminal transition, optional Webhook. | Claimed via `claim_generation_jobs`; idempotent per provider task id. |
+| Wallet | Organization balance with immutable ledger entries. | Posted atomically via `billing_post_wallet_entry`; integer-fen arithmetic. |
+| Ledger | Append-only record of wallet movements (charge, refund, settlement, adjustment). | Replayable for reconciliation. |
+| Quote | Server-side estimate for a generation request using the matched billing rule and parameter tiers. | Preview is quote-only; submission is balance-gated. |
+| Engine / Provider | External generation service: 即梦 (Jimeng), EvoLink GPT Image 2, Seedance 2.0, Bailian. | Adapters isolate provider payloads and status mapping. |
+| Worker | Process that periodically calls the internal Worker tick endpoint to claim and execute jobs. | Node Worker has no RDS credentials; Go embeds a WorkerLoop after cutover. |
+| WorkerLoop | Embedded async task loop inside the Go backend. | Replaces the HTTP-polling Node Worker only after drain and verification. |
+| Cutover | Single-writer routing of `/api`, `/uploads`, `/generated-results` to Go, Node Worker drain, then Next Route Handler deletion. | Must stay reversible; ACK-001 remains truth until it passes. |
+| Contract fixture | Language-neutral JSON contract under `contracts/` for HTTP, Cookie, auth, jobs, billing, storage, Webhook behavior. | Executable by both TypeScript and Go consumers. |
+| `zhinian_session` | Signed (HMAC-SHA256), chunked (3000 chars, up to 20 chunks) session cookie. | `HttpOnly`, `SameSite=Lax`, `Path=/`, production `Secure`. |