v0.20.0 — the outside-review release

The first release whose corrections came from outside. A reader on
r/highfreqtrading read the WAL's durability comment closely enough to see it was
ordered against the wrong thing, and proposed the recovery test that would have
caught it; both are below, credited, because the alternative is pretending the
audit was internal. Shipping alongside them: the interactive tutorial, which
teaches the order book by making you every player in it, on the real engine.

Fixed

• The WAL's durability claim was ordered against the wrong thing. The package
  comment said records are written write-ahead "so no acknowledged command is
  lost." Write-ahead is ordered against apply, not against the acknowledgement a
  client receives: append writes into a buffer, only Sync survives the process,
  and with obgw group-committing every 20ms an order could be acknowledged and
  then vanish. The comment stated the opposite for four releases. A reader on
  r/highfreqtrading pushed on exactly this and was right. The window is now stated
  rather than denied, and obgw -sync-every-command closes it for anyone who
  wants acknowledgement to follow durability — correct, and ~210× the cost,
  because the fsync lands on the matching goroutine.

Added

• Crash-at-every-boundary recovery test. The suite sampled five checkpoints
  across a 2000-command tape and compared only the book; the new test kills at
  every write and emit boundary and compares the trade tape too. Both halves are
  verified against deliberately broken code: dropping every replayed cancel fails
  the book assertion, and publishing replayed event batches in reverse order —
  same event count, so the digest is untouched — fails the tape assertion while
  the old test passes against the identical sabotage. Also proposed by the same
  reader.

• The interactive tutorial (web/learn.html,
  TUTORIAL-SPEC.md) — learn the order book by being
  every player in it, on the real engine. Two devices no static explainer has:
  the ladder assembles itself as concepts arrive (chapter 1 opens on an empty
  market, because a market is a list of intentions and the list starts empty),
  and every objective is verified against the engine's actual book state — "get
  filled before the rival" completes when the book proves it, not when a Next
  button is pressed. Six chapters: the first seller, the wall builder, the
  taker, the queue jumper, the whale (the same 8-lot order against a thin and a
  deep book, with the measured slippage as the lesson), and the market maker,
  quoting both sides of a live market with honest P&L — including the loss
  case, when the price moves through the quotes. Browser-verified end to end;
  the pacing fixes came from watching an impatient automated learner reset its
  own queue position by re-quoting — which is itself the chapter's lesson.

---

Full changelog: v0.19.0...v0.20.0