feat(sync): enforce one-way yinduzhanxing import policy

docs/research/yinduzhanxing_one_way_import_2026_08_06.md

@@ -0,0 +1,24 @@
+# Yinduzhanxing -> Jyotisha one-way import
+
+## Authority boundary
+
+- Direction: `732642856/yinduzhanxing` research source -> `root/Jyotisha` commercial target only.
+- Reverse synchronization is forbidden and is not expressible by the v2 policy or importer CLI.
+- The user-provided source at `../yinduzhanxing-main` is a snapshot without usable Git metadata. Imports from it must record `source_commit=unknown` and a deterministic `source_tree_hash`; they must not claim parity with a GitHub commit.
+- Commercial frontend, identity, billing, database, deployment and commercial truth overlays remain protected.
+
+## Review flow
+
+```bash
+.venv/bin/python scripts/import_yinduzhanxing.py \
+  --source ../yinduzhanxing-main \
+  --policy references/cross_project_contract/sync_policy.v2.json \
+  --dry-run \
+  --output artifacts/yinduzhanxing-import-plan.json
+```
+
+A reviewer must inspect semantic merge rows. Only then may the mirror allowlist be applied. `SKILL.md`, `AGENTS.md`, orchestrators and API entrypoints are semantic-merge paths and are never overwritten by the importer.
+
+## Rollback
+
+Revert the commercial import commit. Preserve the manifest for audit history. Never modify or push the research snapshot as part of rollback.