Usable without the powerbox: headless execution is never a prerequisite

[lannbot]

Records a goal on the headless-at-provider headline question in NOTES.md, from design discussion 2026-08-26 — a narrowing, not a v1 ruling, and marked as such.

Added to "Compute placement and push":

• At least many apps must be usefully usable with no headless copy anywhere — either because they implicitly don't depend on always-on sync, or via asynchronous sharing through a storage backend (the bucket path: ciphertext put/pull, offline authoring reconciled later, cold-start from the bucket alone — machinery the storage layer builds and the TodoMVC end-to-end demo: integrating the UI surface with the engine, both sync paths, and revocation #20 demo proves).
• The powerbox decision ("run an always-on copy at your provider: it will hold keys to X and Y") is an enhancement for apps that genuinely need liveness, never a prerequisite for ordinary use; designs where basic collaboration silently assumes an always-on peer are out.
• What stays open is only the smaller question: whether the powerbox version itself ships in v1.

The open-questions entry reflects the narrowing. Docs-only; just check passes.

Automerge armed per repo convention.