docs(adr): ADR-0011 identity addendum dates its twelve-object count and names the thirteenth (#31648)

<!-- claude-projects-attribution: {"github_login":"os-steve"} -->
_Requested by **Steve** · [project
thread](https://claude.ai/code/project/chan_01FdL1XeUyvVNxLreh3F4Qi9?thread=cmsg_01FdL1XeUyvVNxLreh3F4Qi9UeA8FPbGfY1jB92HZk5Sy9)_

Fixes #31621

Clause-②: no
Metadata-protocol: none

## 维护者速读

- **改了什么**：ADR-0011 身份动作附录里「十二个身份对象」那一句，改成写明这是 2026-10-30 评估时的数，并点名
2026-11-07 修订收进的第 13 个对象 `sys_scim_connection_credential`。
- **为什么改**：这句话读起来像现在的清点，但树上带动作的身份对象已经是 13 个，停在了修订之前（契约复审 6724527824 的 ④
nit）。
- **风险与回滚**：只改 ADR 一句文字，不动代码，不做任何新评估。回滚即 revert 本 PR。
- **先看**：`docs/adr/0011-actions-as-ai-tools.md` 第 317–321 行（附录第一段的第二句）。
- **两分钟验证**：`grep -n "thirteenth"
docs/adr/0011-actions-as-ai-tools.md`，应见一行，紧接
`sys_scim_connection_credential`。
- **需要你做的**：批准本 PR（受管面 Tier H，保持 draft），批准后由席位落地。

## What changes

One sentence in ADR-0011's 2026-10-30 identity addendum. It said the
named actions "on the twelve identity objects in
`packages/platform-objects/src/identity/`" were assessed once, as one
set. That is a count of the 2026-10-30 assessment, but it read as the
current census: the 2026-11-07 amendment (in the same addendum) brought
`sys_scim_connection_credential`'s two actions into the buckets, so
thirteen objects carry named actions today.

The sentence keeps the twelve, dates it to the 2026-10-30 assessment
("the twelve identity objects that carried them ... at the 2026-10-30
assessment"), and adds that the 2026-11-07 amendment brought in a
thirteenth, `sys_scim_connection_credential`. Both the history
("assessed once, as one set") and the present count stay true. No other
paragraph of the ADR changes. No action is assessed:
`sys_user.list_platform_admins` and
`sys_sso_provider.edit_sso_sign_in_options` are left to the maintainer
ruling the card names.

## Why

Contract review 6724527824 on PR #31616, finding ④ (nit, outside that
diff). Card #31621.

## Verification

Premise measured on `origin/main` `99364ea7`: every `*.object.ts` under
`packages/platform-objects/src/identity/` was read for an `actions: [`
array (and for any other `actions` spelling: none). 13 objects carry
one: `sys_account`, `sys_api_key`, `sys_invitation`, `sys_member`,
`sys_oauth_application`, `sys_organization`,
`sys_scim_connection_credential`, `sys_session`, `sys_sso_provider`,
`sys_team_member`, `sys_team`, `sys_two_factor`, `sys_user`. The H/C/E
lists name exactly these 13 object prefixes; the 12 without
`sys_scim_connection_credential` are the 2026-10-30 set.

<details><summary>Gates (dispatch-gates --commands at 20a1c07: 21
derived, 21 run, all exit 0)</summary>

```text
node scripts/check-adr-links.mjs :: exit 0
node scripts/check-adr-links.mjs --self-test :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0
pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0
pnpm check:adr-anchors :: exit 0
pnpm check:adr-index :: exit 0
pnpm check:adr-symbol-anchors :: exit 0
pnpm check:ci-filter-parity :: exit 0
pnpm check:closed-ceremony-text :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:pm-governed-merges :: exit 0
pnpm check:pm-prior-rulings :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:watch-hint-literal :: exit 0
```

`check:doc-formula-expressions` first exited 3 (prerequisite not met:
`@objectstack/formula` / `@objectstack/lint` dist absent, nothing
measured); after `turbo run build --filter=@objectstack/formula
--filter=@objectstack/lint` it ran and exited 0. Reconciliation:
`dispatch-gates --ran`: 21 derived, 21 run, 0 NOT-MEASURED, 0 UNRUN. No
package is touched, so no `pnpm lint`, test or typecheck is owed.

</details>

## Acceptance notes

- Open PR #31616 edits the same file (the census and "Not assessed"
paragraphs, not this sentence). Whichever lands second merges
`origin/main`; the seat decides the order.
- Governed surface (`docs/adr/**`, Tier H): this PR stays draft until a
`GOVERNED_APPROVERS` approval.
- No changeset: `docs/adr/**` publishes nothing (`skip-changeset`).

## Human Minimum

- [x] 1. Schemas start as Zod; `packages/spec` holds no runtime logic.
(not touched)
- [x] 2. Every name I added uses the casing for its kind. (no names)
- [x] 3. No formatter ran; `pnpm lint` passes. (no lintable file
touched)
- [x] 4. One issue, one branch off an up-to-date `main`, one pull
request.
- [x] 5. A change that publishes carries a changeset, and both
declaration lines are filled in here and in the changeset. (publishes
nothing)
- [x] 6. `packages/spec` touched: its generated artifacts are
regenerated and committed. (not touched)
- [x] 7. No hand edits to `content/docs/references/`,
`packages/*/CHANGELOG.md` or `content/docs/releases/`.
- [x] 8. Title, body and comments are in English.
- [x] The *Before Submitting* list in CONTRIBUTING.md is done.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01ADHkmRbRXBo8uDXg21xy8x)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

docs/adr/0011-actions-as-ai-tools.md

@@ -315,8 +315,10 @@ ships next.
 
 The opt-in binds the platform's `sys_*` actions exactly as it binds an app's: an action reaches an
 agent only when it declares `ai: { exposed: true, description }`. The named actions on the twelve
-identity objects in `packages/platform-objects/src/identity/` were assessed once, as one set, into
-three buckets, and the declarations were written in the same change as this addendum.
+identity objects that carried them in `packages/platform-objects/src/identity/` at the 2026-10-30
+assessment were assessed once, as one set, into three buckets, and the declarations were written in
+the same change as this addendum; the 2026-11-07 amendment below brought in a thirteenth,
+`sys_scim_connection_credential`.
 
 | Bucket | Test | What the action declares |
 |:--|:--|:--|