[P2] documentation sync (4 design docs) + final acceptance evidence

[qqeasonchen]

Tracking sub-issue of #5354. Part of the production-HA acceptance plan (Phase 4, P2).

What this PR changes

The four design documents that #5352 / #5353 / #5354 explicitly call out are updated to reflect the actual runtime behavior after #5359 / #5360 / #5361 / #5362 / #5363 / #5364 land. A row is added to docs/architecture-review/evidence.md for each of the 8 tracking issues.

Doc changes

• docs/eventmesh-architecture.md section "Control plane": replace the "wiring is a follow-up" sentence with the actual boot-time MetaStore wiring and the explicit fail-fast messages.
• docs/control-plane.md sections 1.2 / 1.3 / 4: document the PARTITION_OWNED_PULL fail-fast paths, the A2A operation classification, and the admin security posture.
• docs/production-readiness.md sections 5 / 6 / 7: link to the Testcontainers harness, the chaos test matrix, the supported backend × topology matrix, and the metrics + alert table.
• docs/eventmesh-offset-lb-frame-design.md section 3: add the FrameLimits table (max frame 16 MiB, max payload 8 MiB, max attrs 64, max attr-name 256 B, max attr-value 4 KiB); document the immutable API; document the streaming isFinal semantics.

docs/architecture-review/production-ha-plan.md

The plan document is the source of truth for the topology. This issue adds:

• the status legend that already exists in evidence.md from the [Architecture Review] Consolidate EventMesh boundaries and production-grade consistency #5296 review, but adapted for the production-HA scope (BACKLOG / MERGED / OPEN-CI-startup_failure);
• a per-issue row in the evidence table for each of [P0] arch-guard: ban InMemoryMetaStore and poll-all fallback in cluster mode #5356, [P0] arch-guard: ban mutable EventMeshFrame and unbounded attribute maps #5357, [P0] arch-guard: ban raw QuotaManager calls (force release-handle) #5358, [P0] wire DeliveryTopology + MetaStore + FencingToken into UniRuntime boot (fail-fast) #5359, [P0] propagate FencingToken epoch through dispatch / ACK / offset / DLQ #5360, [P0] harden EventMeshFrame: FrameLimits, immutability, fuzz/boundary tests #5361, [P1] QuotaHandle (AutoCloseable) + A2A operation classification #5362, [P1] Testcontainers E2E: cross-instance takeover + crash/restart + stale-owner #5363, [P1] chaos (MetaStore / broker / watch / RocksDB) + rolling upgrade + admin security #5364, with PR + commit + test files + test command + CI run + backend + version + topology + result;
• a final cross-link from [Bug] Production HA acceptance: wiring, takeover, chaos tests, and evidence #5354 / [Bug] Harden data-path reliability, deferred ACK, and Frame safety #5352 / [Bug] Harden DeliveryTopology, SecurityGate, and control-plane fencing #5353 to the updated plan document so the three parent issues can be closed.

Acceptance criteria

• All 4 design docs updated; the changes are linked from [Bug] Harden data-path reliability, deferred ACK, and Frame safety #5352 / [Bug] Harden DeliveryTopology, SecurityGate, and control-plane fencing #5353 / [Bug] Production HA acceptance: wiring, takeover, chaos tests, and evidence #5354.
• 8 new rows in docs/architecture-review/evidence.md (or in a new production-ha-evidence.md); the existing [Architecture Review] Consolidate EventMesh boundaries and production-grade consistency #5296 evidence table is preserved.
• PR description closes [Bug] Harden data-path reliability, deferred ACK, and Frame safety #5352, [Bug] Harden DeliveryTopology, SecurityGate, and control-plane fencing #5353, [Bug] Production HA acceptance: wiring, takeover, chaos tests, and evidence #5354 by linking to the updated plan document.
• The new production-ha-plan.md is reviewed by the PMC before the parent issues are closed (per the user note on 2026-09-08: PMC sign-off is required for closing any of [Bug] Harden data-path reliability, deferred ACK, and Frame safety #5352 / [Bug] Harden DeliveryTopology, SecurityGate, and control-plane fencing #5353 / [Bug] Production HA acceptance: wiring, takeover, chaos tests, and evidence #5354 directly; sub-issues close via the PR that delivers their acceptance criteria).

Verification

This is a docs PR. The verification is:

# docs build
mkdocs build --strict  # or the project's doc build command

# cross-link check
grep -r 'docs/architecture-review/production-ha-plan.md' docs/
grep -r 'docs/eventmesh-architecture.md' docs/control-plane.md
grep -r 'docs/control-plane.md' docs/production-readiness.md

Depends on / blocks

• Depends on: [P1] chaos (MetaStore / broker / watch / RocksDB) + rolling upgrade + admin security #5364 (chaos + admin work must be merged before the docs reflect it).
• Blocks: closure of [Bug] Harden data-path reliability, deferred ACK, and Frame safety #5352, [Bug] Harden DeliveryTopology, SecurityGate, and control-plane fencing #5353, [Bug] Production HA acceptance: wiring, takeover, chaos tests, and evidence #5354 (per the parent issue's acceptance criterion init repo #1: "[Bug] Harden data-path reliability, deferred ACK, and Frame safety #5352 and [Bug] Harden DeliveryTopology, SecurityGate, and control-plane fencing #5353 acceptance criteria are completed and linked to concrete commits and tests").

References

• docs/eventmesh-architecture.md
• docs/control-plane.md
• docs/production-readiness.md
• docs/eventmesh-offset-lb-frame-design.md
• docs/architecture-review/production-ha-plan.md (new)
• docs/architecture-review/evidence.md (existing, will be appended)

Part of the production-HA topology in #5354. See also #5352 and #5353.