docs: раздел «Реестр исключений» + диалог код-ревью opus/astra

TOOLS/ARCHITECTURE.md

@@ -212,3 +212,31 @@ From the unified YAML, generate:
 - No manual edits to generated YAML or generated Go code.
 - Any change must come from API or generator logic updates.
 - The generator must enforce these rules and fail fast on drift.
+
+## Exception Registry (service-specific DATA, never logic)
+
+Principle: provider core and generator logic are universal for all stands and
+services. The ONLY allowed deviations are DATA entries, and they MUST live in
+exactly two named registries:
+
+| Registry | File | Declares |
+|---|---|---|
+| `serviceSpecificModifiers` | `TOOLS/yaml-generator/main.go` | which service `modify` op becomes a modifier resource and its name (key = normalized service name) |
+| `serviceSpecificDocExamples` | `TOOLS/docs-generator/internal/writers/writers.go` | per-service doc examples, gated on service name + required state/vault keys |
+
+Rules:
+
+- Key by stable service NAME (slug), never by raw numeric ID.
+- Each entry answers WHAT / WHAT IT DOES / WHY / WHERE (see code comments).
+- Adding an exception = editing one of these two registries → visible in diff.
+- Never annotate API-YAML: it is machine-regenerated and edits would be lost.
+
+Enforced by scripts (run before build/commit):
+
+- `TOOLS/scripts/check_generated_drift.sh <stand>` — generated Go vs provider copy.
+- `TOOLS/scripts/check_hardcoded_service_ids.sh` — forbids `svc.ID == N` /
+  `ServiceID == N` outside the registries.
+
+Build rule: `provider/internal/resources_gen` is a transient sync copy, never a
+build source. Canonical build is `03_build_and_upload_provider.sh` (temp copy from
+`generated/<stand>/go`); `build-provider.sh` refuses direct build from `provider/`.