docs: 明确 Job 停止、观察与可信读取合同

20-product-tdd/knowledge-capability-contract.md

@@ -173,6 +173,14 @@ external API uses one of those words.
   capability-handler, eligibility, atomic-claim, execution, and closure path. A Job has no
   retry or business-specific completeness semantics; timeout is a per-attempt execution
   budget, while partial progress and checkpointing remain owned by the invoked capability.
+- Job admission only confirms persistence; the admitting Peer need not be an eligible executor.
+  `abort_requested` records best-effort stop intent. Pending work may close as aborted immediately;
+  running work stays running until its executor has exited and released its resources. Repeated
+  requests do not rewrite terminal outcomes. Stopping never promises rollback, retry, or reversal
+  of already dispatched external work. Each executor observes stop intent for its own active work.
+- An observer's wait budget is separate from the Job execution budget. Ending observation does not
+  request cancellation. A final observed record is evidence of that observation, not a claim that
+  the database has remained unchanged since it was read.
 - A Cron is global command-creation policy, not a hidden execution path or a Source-owned
   schedule. A due occurrence is materialized under database serialization with one
   `scheduled_for` identity and at most one outstanding Job. Missed occurrences remain missed;

20-product-tdd/system-state-and-authority.md

@@ -17,6 +17,11 @@ Record durable ownership of authoritative state across units and distinguish it
   authority, not request-path or product-tier authority over other peers.
 - Production rows are operational recovery data and must never be reproduced as development
   seed.
+- Input validation belongs at the accepting boundary. A normal record read does not reapply
+  business input validation or require the corresponding runtime schema to be loaded. An execution
+  path may restore persisted representations into its language's types; it need not repeatedly
+  revalidate values already restored by that owner. Runtime capability checks remain separate
+  from the authority of saved records.
 
 ## Extension Installation Authority