docs: D2 tail-object cleanup, and why the refusal is the design Adds the D2 section to Design-Tail-Replication plus the v0.9.0 release row. The part worth reading is not the deletion but the refusal: the watermark stops at the first non-durable part, because max-over-durable skips a local-only part in the middle and would authorise deleting a tail object whose records exist nowhere off-box. Records both mutants that the safety test catches, and why tail_objects_retained is a gauge. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
docs: B3 — the unsealed tail replicates off-box, and the lock boundary New page Design-Tail-Replication: the measured gap (prod seal interval 900s with oldest_unsealed_age 719 and nothing waiting to upload), why per-batch objects rather than re-uploading the part, the three invariants and what each prevents, the RED-control-first evidence, and the six series. Also records the v0.8.1 lock-boundary fix, because it is the kind of thing someone adding another timer-driven substrate method needs to read first: the remote put must not run under the engine lock the live append path takes. Framing kept honest throughout: the tick IS the loss window, so B3 takes it from 900s to 15s — bounded, not zero. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>