search and ai stabilization work, localization stablized.

docs/modules/scanner/architecture.md

@@ -222,9 +222,16 @@ POST /reports                      { imageDigest, policyRevision? } → { r
 GET  /catalog/artifacts/{id}       → { meta }
 GET  /healthz | /readyz | /metrics
 ```
-See docs/modules/scanner/byos-ingestion.md for BYOS workflow, formats, and troubleshooting.
-
-### Report events
+See docs/modules/scanner/byos-ingestion.md for BYOS workflow, formats, and troubleshooting.
+
+### 4.1 Localization runtime contract (Sprint 20260224_002)
+
+- Scanner.WebService initializes localization via `AddStellaOpsLocalization(...)`, `AddTranslationBundle(...)`, `AddRemoteTranslationBundles()`, `UseStellaOpsLocalization()`, and `LoadTranslationsAsync()`.
+- Locale resolution order is deterministic: `X-Locale` header -> `Accept-Language` header -> configured default locale (`en-US`).
+- Translation source layering is deterministic: embedded shared `common` bundle (library) -> embedded Scanner bundle (`Translations/*.scanner.json`) -> Platform runtime overrides fetched through the remote provider.
+- Current localized API responses in this rollout are provided for `en-US` and `de-DE` (for example, slice query validation and not-found responses).
+
+### Report events
 
 When `scanner.events.enabled = true`, the WebService serialises the signed report (canonical JSON + DSSE envelope) with `NotifyCanonicalJsonSerializer` and publishes two Redis Stream entries (`scanner.report.ready`, `scanner.scan.completed`) to the configured stream (default `stella.events`). The stream fields carry the whole envelope plus lightweight headers (`kind`, `tenant`, `ts`) so Notify and UI timelines can consume the event bus without recomputing signatures. Publish timeouts and bounded stream length are controlled via `scanner:events:publishTimeoutSeconds` and `scanner:events:maxStreamLength`. If the queue driver is already Redis and no explicit events DSN is provided, the host reuses the queue connection and auto-enables event emission so deployments get live envelopes without extra wiring. Compose/Helm bundles expose the same knobs via the `SCANNER__EVENTS__*` environment variables for quick tuning.