[pournasserian]

Closes #2752

Records in docs/planning/backend-technical-spec.md what #2747 (content service) and #2748 (job runner) shipped and the spec did not say, each checked against the merged code. Section 4.2 gets fallbacks as a reserved name. Section 4.4 gets PatchAsync, the two new exceptions, SystemOperation, how a refusal differs from not found, and the audit principal. Section 4.8 gets the global-type write rule and the shared-field rule. Section 4.12 gets the actor and principal rule, cms_recurring_job.type, AddRecurringAsync, IJobDeadLetters, job registration and the claim index. Section 9.2 lists #2749, #2750 and #2751. No other decision is changed.

Dependencies: none.

Acceptance

• Each choice named in the task is recorded as the merged code has it
• Disagreements that are more than wording are listed below, not edited
• markdownlint-cli2 reports no issues

Disagreements left as written

• Unique values and the trash. Spec 4.4 says uniqueness runs "both states, per site and locale". The service also counts trashed entries, so only a purge (Trash with retention and purge job #2696) frees a value. I added this as a bullet and left the sentence.
• After-commit events. Spec 4.4 says events are dispatched after commit. The sink hears nothing of a write made in a transaction the service did not begin, so such a write is never announced (Add the content service with optimistic concurrency #2747, "The sink"). Bulk operations with per-item results and a filter cap #2703 and In-process event bus with after-commit dispatch and outbox #2697 depend on this.
• Scalar job payloads on SQL Server. Spec 4.12 stores payload json. ISJSON there refuses a scalar, so enqueueing an IJob<int> or IJob<string> fails while SQLite and PostgreSQL accept it. Validate and complete the PostgreSQL and SQL Server providers #2711 has to choose between a wrapper object and a rule that payloads are objects.
• Lease clocks and delivery. Spec 4.12 says "multi-instance safe". Delivery is at least once, and leases use each instance's clock, so skew above lease minus heartbeat (4 minutes) can take a job from a healthy worker. The spec does not say so, and Validate and complete the PostgreSQL and SQL Server providers #2711 may move to the database clock.
• Type name first. Spec 4.4 shows UpdateAsync(id, entry, expectedVersion). Every IContentService method takes the type name first. I wrote that in the new contract paragraph and left the table's short forms.
• Hook field limits. Add the authorization evaluator and row rules #2743's comment says the system principal is how a hook sets a hidden field. A hook cannot change its principal, so the service allows a hook to change Hidden and ReadOnly fields instead, and refuses any other field outside the grants. The new contract paragraph records the shipped rule.